Verify Maxforms webhook signatures before trusting events

This function uses Node.js built-in crypto. Pass the raw body as a Buffer and lowercase header names from your HTTP server.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyMaxformsWebhook(secret, rawBody, headers) {
  const id = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signatures = headers['webhook-signature'];

  if (typeof secret !== 'string' || !secret || !Buffer.isBuffer(rawBody)) {
    return false;
  }
  if (typeof id !== 'string' || !id || typeof timestamp !== 'string' ||
      typeof signatures !== 'string' || !/^\d+$/.test(timestamp)) {
    return false;
  }

  const sentAt = Number(timestamp);
  if (!Number.isSafeInteger(sentAt) ||
      Math.abs(Math.floor(Date.now() / 1000) - sentAt) > 300) {
    return false;
  }

  let key = Buffer.from(secret, 'utf8');
  if (secret.startsWith('whsec_')) {
    const encoded = secret.slice(6);
    key = Buffer.from(encoded, 'base64');
    if (!key.length || key.toString('base64') !== encoded) {
      return false;
    }
  }

  const expected = createHmac('sha256', key)
    .update(`${id}.${timestamp}.`)
    .update(rawBody)
    .digest();

  return signatures.split(/\s+/).some((signature) => {
    const match = /^v1,([A-Za-z0-9+/]+={0,2})$/.exec(signature);
    if (!match) {
      return false;
    }
    const received = Buffer.from(match[1], 'base64');
    return received.toString('base64') === match[1] &&
      received.length === expected.length &&
      timingSafeEqual(received, expected);
  });
}

Call verifyMaxformsWebhook(process.env.MAXFORMS_WEBHOOK_SECRET, rawBody, request.headers) before parsing the body. On false, reject the request. Never hardcode the real secret into source control.