웹훅 서명 검증

import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.METERENGINE_WEBHOOK_SECRET; // whsec_ 로 시작하는 값
const TOLERANCE_SECONDS = 300;

function verifyMeterEngineWebhook(rawBody, headers, secret) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatureHeader = headers["webhook-signature"];
  if (!id || !timestamp || !signatureHeader) return false;

  if (!/^\d+$/.test(timestamp)) return false;
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const key = Buffer.from(secret.slice("whsec_".length), "base64");
  const expected = Buffer.from(
    createHmac("sha256", key)
      .update(`${id}.${timestamp}.`)
      .update(rawBody)
      .digest("base64"),
  );

  return signatureHeader.split(" ").some((candidate) => {
    if (!candidate.startsWith("v1,")) return false;
    const actual = Buffer.from(candidate.slice("v1,".length));
    return actual.length === expected.length && timingSafeEqual(actual, expected);
  });
}

createServer((req, res) => {
  if (req.method !== "POST" || req.url !== "/webhooks/meterengine") {
    res.writeHead(404).end();
    return;
  }
  const chunks = [];
  req.on("data", (chunk) => chunks.push(chunk));
  req.on("end", () => {
    const rawBody = Buffer.concat(chunks);
    if (!verifyMeterEngineWebhook(rawBody, req.headers, SECRET)) {
      res.writeHead(400).end();
      return;
    }
    const event = JSON.parse(rawBody.toString("utf8"));
    // webhook-id로 중복을 거르고, 처리는 큐에 넘긴 뒤 바로 응답합니다.
    res.writeHead(204).end();
  });
}).listen(8080);

// Next.js 라우트 핸들러처럼 웹 표준 Request를 받는 환경
import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

function verifyMeterEngineWebhook(rawBody, headers, secret) {
  const id = headers.get("webhook-id");
  const timestamp = headers.get("webhook-timestamp");
  const signatureHeader = headers.get("webhook-signature");
  if (!id || !timestamp || !signatureHeader) return false;

  if (!/^\d+$/.test(timestamp)) return false;
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const key = Buffer.from(secret.slice("whsec_".length), "base64");
  const expected = Buffer.from(
    createHmac("sha256", key).update(`${id}.${timestamp}.`).update(rawBody).digest("base64"),
  );
  return signatureHeader.split(" ").some((candidate) => {
    if (!candidate.startsWith("v1,")) return false;
    const actual = Buffer.from(candidate.slice("v1,".length));
    return actual.length === expected.length && timingSafeEqual(actual, expected);
  });
}

export async function POST(request) {
  const rawBody = Buffer.from(await request.arrayBuffer());
  if (!verifyMeterEngineWebhook(rawBody, request.headers, process.env.METERENGINE_WEBHOOK_SECRET)) {
    return new Response(null, { status: 400 });
  }
  const event = JSON.parse(rawBody.toString("utf8"));
  // webhook-id로 중복을 거르고, 처리는 큐에 넘긴 뒤 바로 응답합니다.
  return new Response(null, { status: 204 });
}

id        = 헤더 webhook-id
timestamp = 헤더 webhook-timestamp
header    = 헤더 webhook-signature
이 헤더 가운데 하나라도 없으면 거절

timestamp가 숫자가 아니거나 |지금(Unix 초) - timestamp| > 허용 범위 이면 거절

key      = base64_decode(비밀값에서 "whsec_"를 뗀 나머지)
expected = base64(HMAC_SHA256(key, id + "." + timestamp + "." + 원문 바이트))

header를 공백으로 나눈 각 값 s에 대해:
  s가 "v1,"로 시작하고 상수_시간_비교(s에서 "v1,"를 뗀 값, expected)가 참이면 통과
하나도 없으면 거절