Senior LevelExpress JS
How do you build a high-reliability Webhook ingestion engine in Express with cryptographic signature verification?
❓ Interview Prompt: Explain Webhook ingestion, raw Buffer signature verification (stripe.webhooks.constructEvent), avoiding express.json() mangling, and async queue processing.
Webhook endpoints (e.g. Stripe, Twilio) verify authenticity by computing an HMAC-SHA256 signature of the exact raw request body Buffer.
Ingestion Architecture:
1
Raw Body Parsing: Mount webhook routes BEFORE 'express.json()' using 'express.raw({ type: "application/json" })'.
2
Signature Verification: Verify signature using the raw Buffer.
3
Immediate 200 OK + Async Queue: Push verified event payload to a Kafka/RabbitMQ queue and return 200 OK within 500ms to prevent sender timeouts!
Code Implementation Example
javascript
import express from 'express';
import Stripe from 'stripe';
const app = express();
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
// Mount raw Buffer parser specifically for Stripe webhook signature verification!
app.post('/api/webhooks/stripe', express.raw({ type: 'application/json' }), async (req, res) => {
const sig = req.headers['stripe-signature'];
let event;
try {
// Requires exact raw Buffer! If express.json() parsed it previously, verification FAILS!
event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);
} catch (err) {
return res.status(400).send(`Webhook Error: ${err.message}`);
}
// Push to queue for async background processing & return 200 OK immediately!
await messageQueue.push(event);
res.json({ received: true });
});💡High-reliability Webhook ingestion engine with raw Buffer HMAC verification.
🎯 Interview Key Takeaway
Use express.raw() on Webhook endpoints to preserve the exact raw Buffer needed for HMAC signature verification.
#Webhooks#Stripe#Raw Buffer#Security#Senior
Back to all Express JS Questions→