How to Validate Payload From Webhook
Hi,
So, i have been trying to validate incoming whatsapp webhooks payload from meta by following the guide in this link
https://developers.facebook.com/docs/graph-api/webhooks/getting-started/#validate-payloads
I have figured on how to validate message statuts update & incoming message webhook like text, image, video, etc. But i am stuck on validating webhook from Account Update or Template Status Update.
Below is the code i am using
const crypto = require('crypto'); const express = require('express');
const app = express(); app.use(express.json());
const APP_SECRET = "YOUR_APP_SECRET";
function escapeUnicode(str) { return str.replace(/[\u0080-\uFFFF]/g, function (ch) { return '\u' + ('0000' + ch.charCodeAt(0).toString(16)).slice(-4); }).replace(/\//g, '\/'); // Escape / as \/ }
function verifySignature(req) { const signature = req.headers['x-hub-signature-256'];
if (!signature) return false;
let payload = JSON.stringify(req.body);
payload = escapeUnicode(payload);
const hash = `sha256=${crypto.createHmac('sha256', APP_SECRET).update(payload).digest('hex')}`;
console.log({ payload, signature, hash })
return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(hash));
}
app.post('/webhooks', (req, res) => { if (!verifySignature(req)) { console.log("Invalid signature") return res.status(403).send("Invalid signature"); }
console.log("Received valid webhook event:", req.body);
res.sendStatus(200);
});
app.listen(3000, () => console.log("Webhook listening on port 3000"));