Laufzeitsichere HMAC-Signatur-Verifizierung in Route-Handlern

import crypto from 'node:crypto';
 
export function verifyWebhookSignature(payload, signature, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(payload, 'utf8');
  const expectedSignature = hmac.digest('hex');
 
  const trustedBuffer = Buffer.from(expectedSignature, 'utf8');
  const untrustedBuffer = Buffer.from(signature, 'utf8');
 
  if (trustedBuffer.length !== untrustedBuffer.length) {
    return false;
  }
 
  return crypto.timingSafeEqual(trustedBuffer, untrustedBuffer);
}