Security: Use timing-safe comparison for webhook signatures

[coderabbitai]

Description

Currently, the webhook signature validation in src/app/api/webhook/route.ts uses a simple string equality check:

if (signature !== expectedSignature) {
  return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
}

This approach is vulnerable to timing attacks, where attackers can potentially determine the expected signature by measuring response times.

Recommendation

Replace the string comparison with a timing-safe comparison using crypto.timingSafeEqual:

const signatureBuffer = Buffer.from(signature || "", "hex");
const expectedSignatureBuffer = Buffer.from(expectedSignature, "hex");
if (
  signatureBuffer.length !== expectedSignatureBuffer.length ||
  !crypto.timingSafeEqual(signatureBuffer, expectedSignatureBuffer)
) {
  return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
}

References

• PR: feat: Add recurring invoice support with recurrence details #29
• Comment
• Node.js crypto.timingSafeEqual documentation