Repository navigation
Export verifyWebhookSignature as standalone function from webhooks/verify.ts #617
Description
Description
src/webhooks/verify.ts contains signature verification logic but it is not exported as a standalone function from src/index.ts. Consumers building their own webhook receivers cannot import the verifier directly — they must copy the logic. This issue exposes it as a first-class SDK export.
Acceptance Criteria
-
verifyWebhookSignature(payload: string, signature: string, secret: string): booleanexported fromsrc/webhooks/verify.ts - Uses HMAC-SHA256:
crypto.createHmac('sha256', secret).update(payload).digest('hex')and compares withsignatureusing a timing-safe comparison (crypto.timingSafeEqual) - Returns
false(never throws) when signature is malformed or lengths differ -
WebhookVerificationErrorclass exported for consumers who prefer throwing — wrapsverifyWebhookSignatureand throws if it returnsfalse - Both exported from
src/index.ts - Unit tests: valid signature returns true, wrong secret returns false, tampered payload returns false, mismatched length returns false without throwing
Context
- Target files:
src/webhooks/verify.ts,src/index.ts - Must use
crypto.timingSafeEqualto prevent timing attacks — not===
Activity
waterWang commentedon Aug 20, 2026
/attempt
Would like to take this bounty. I will implement
verifyWebhookSignaturewith HMAC-SHA256 +crypto.timingSafeEqual, addWebhookVerificationError, export both fromsrc/index.ts, and write unit tests covering valid signature / wrong secret / tampered payload / mismatched length. Expect a PR shortly.ZacLou commentedon Sep 6, 2026
I'd like to take this on. The implementation is well-defined: export
verifyWebhookSignaturefromsrc/webhooks/verify.tsusing HMAC-SHA256 withcrypto.timingSafeEqualfor timing-safe comparison, plus aWebhookVerificationErrorclass that wraps it and throws on failure.I have prior context on this codebase from PR #810 (searchByMemo, currently open). Happy to deliver a clean PR with full unit test coverage once assigned.
woahwhattheheck commentedon Sep 6, 2026
Submitted a PR for this: #829
It covers the acceptance criteria above, and also fixes a crash I hit while
implementing them.
verifyWebhookSignaturecurrently throwsTypeErrorrather than returning
falsewhen the secret or payload is not a string —the hex guard runs before
createHmac()/.update()receive them:That is the common case in a webhook route: an unset
WEBHOOK_SECRET, orreq.bodyread before a body parser runs, becomes a 500 instead of a 401.One design note worth flagging:
src/index.tsalready exports averifyWebhookSignature— the async, isomorphic one from./webhookMiddleware.js, which also accepts an object payload. Re-exportingthe synchronous Node-only helper under that same name would replace it and
break object-payload callers and browser/edge consumers. So the PR keeps the
existing export as-is and adds the sync helper as
verifyWebhookSignatureSyncalongside
WebhookVerificationErrorandassertWebhookSignature. Glad toconsolidate the two verifiers into one entry point instead if that is the
direction you want — that felt like an API call for a maintainer rather than
something to decide inside a bug fix.
ci: add temporary verification workflow for Stellar-split#617 branch …
woahwhattheheck commentedon Sep 6, 2026
@waterWang @ZacLou — I owe you both a correction.
You each asked for this issue before I did: @waterWang on 20 August and
@ZacLou earlier today. I opened PR #829 without asking for assignment at all
and without acknowledging your claims, which was wrong twice over —
CONTRIBUTING is explicit that coding starts only after a maintainer assigns
the issue, and I had not read it.
Other contributors' earlier requests and original authorship remain acknowledged. PR #829 includes my proposed
TypeErrorcorrection beyond the requested export. Please assess that submitted contribution and its payment claim under the project's assignment and bounty requirements.Claim correction (2026-10-09): My contribution/payment claim remains ACTIVE. I demand payment for my submitted contribution under the applicable bounty terms. Please provide the review outcome, any specific remaining acceptance or registration requirement, and the payment date. Any assignment dispute or closed issue/PR status leaves this payment demand active. Recipient: Bryce / Token Junkie Labs, @woahwhattheheck. I will provide verified receiving details through the project's official payment channel. No waiver, withdrawal, transfer, split, or reduction of my claim is authorized.
ranjeet150 commentedon Sep 15, 2026
Hello @maintainers,
I am interested in working on this issue.
Plan:
Export verifyWebhookSignature as standalone function from webhooks/verify.tsaddressing all stated requirements.Looking forward to collaborating on this—please assign!
GreatShinro commentedon Oct 21, 2026
@GreatShinro has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @GreatShinro to this issue.
sampapiz commentedon Oct 21, 2026
@sampapiz has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @sampapiz to this issue.
Raydev-tech commentedon Oct 21, 2026
@Raydev-tech has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Raydev-tech to this issue.
Phantomcall commentedon Oct 21, 2026
@Phantomcall has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Phantomcall to this issue.
drips-wave commentedon Oct 21, 2026
Congratulations, @Phantomcall! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @Phantomcall: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
feat(sdk): add webhook verification, array pagination, and metadata c…
drips-wave commentedon Oct 21, 2026
This issue has been completed by @Phantomcall as part of the Stellar Wave Program's 10th Wave 🥳
😎 @Phantomcall: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
grantfox-oss commentedon Oct 21, 2026
🎉 This issue has been marked as completed on GrantFox!
@Phantomcall's PR #1216 was approved and merged by @Kingsman-99.
🏆 @Phantomcall: You earned 40 FoxPoints for this contribution! Your current tier: Builder (2,065 total points). Track your full progress on GrantFox.
👏 Great work, @Phantomcall! Keep contributing to Stellar-split.