HMAC-Signaturverifizierung mittels Web Crypto API in Next.js Route-Handlern

import { NextResponse } from 'next/server';
 
export async function POST(request) {
  const secret = process.env.WEBHOOK_SECRET;
  const signature = request.headers.get('x-signature');
  const rawBody = await request.arrayBuffer();
  const key = await crypto.subtle.importKey(
    'raw',
    new TextEncoder().encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['verify']
  );
  const sigBuffer = Uint8Array.from(Buffer.from(signature || '', 'hex'));
  const isValid = await crypto.subtle.verify('HMAC', key, sigBuffer, rawBody);
  if (!isValid) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  return NextResponse.json({ success: true });
}