从Shopify Webhook验证HMAC (使用Hapijs)

const Hapi = require('@hapi/hapi');
const crypto = require('crypto');

const server = Hapi.server({
  port: 3000,
  host: 'localhost'
});

server.route({
  method: 'POST',
  path: '/webhook',
  handler: (request, h) => {
    const hmacHeader = request.headers['x-shopify-hmac-sha256'];
    const requestBody = request.payload;

    // 使用密钥和请求体计算HMAC
    const secret = 'your_shopify_webhook_secret';
    const calculatedHmac = crypto
      .createHmac('sha256', secret)
      .update(requestBody, 'utf8')
      .digest('base64');

    // 比较计算得到的HMAC与请求中的HMAC
    if (hmacHeader === calculatedHmac) {
      // HMAC验证通过，处理Webhook请求
      console.log('Valid webhook request');
      return h.response().code(200);
    } else {
      // HMAC验证失败，拒绝请求
      console.log('Invalid webhook request');
      return h.response().code(401);
    }
  }
});

async function startServer() {
  try {
    await server.start();
    console.log('Server running at:', server.info.uri);
  } catch (err) {
    console.log('Error starting server:', err);
  }
}

startServer();