I will harden one existing Node.js webhook endpoint with deterministic HMAC signature verification and replay protection.
The basic package covers one webhook route in an Express, Fastify, or similar Node/TypeScript service. I will implement or repair:
- raw-body signature verification;- constant-time signature comparison;- configurable timestamp tolerance;- rejection of missing, malformed, stale, or invalid signatures;- replay detection for repeated event identifiers;- five automated tests for valid, invalid, missing, stale, and replayed events;- a short setup and verification note.
You receive the source patch, tests, sanitized fixtures, and concise implementation notes. One revision is included for corrections within the agreed route and signing scheme.
I do not need production secrets, seed phrases, private keys, live funds, or customer data. A test signing secret and sanitized payload are enough.
This package is for one endpoint and one documented signing scheme. Provider-specific SDK work, database migrations, deployment, and multi-endpoint integrations require a custom quote.