From 29dbc8ba8f6bb2d82b5274d3d0934e3dbb88523b Mon Sep 17 00:00:00 2001 From: Giuseppe Lombardo Date: Wed, 12 Aug 2026 16:31:06 +0000 Subject: [PATCH] add backend/src/modules/banking/signature.ts --- backend/src/modules/banking/signature.ts | 26 ++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 backend/src/modules/banking/signature.ts diff --git a/backend/src/modules/banking/signature.ts b/backend/src/modules/banking/signature.ts new file mode 100644 index 0000000..7bfcba7 --- /dev/null +++ b/backend/src/modules/banking/signature.ts @@ -0,0 +1,26 @@ +import crypto from 'crypto'; + +/** + * Verifiziert die HMAC-SHA256-Signatur eines eingehenden Banking-Webhooks. + * Der Provider (z.B. FinAPI/Nordigen) signiert den rohen Request-Body mit + * einem gemeinsamen Secret. Timing-safe Vergleich verhindert Timing-Attacken. + */ +export function verifyWebhookSignature( + rawBody: string, + signatureHeader: string | undefined, + secret: string, +): boolean { + if (!signatureHeader) return false; + + const expected = crypto + .createHmac('sha256', secret) + .update(rawBody, 'utf8') + .digest('hex'); + + const expectedBuf = Buffer.from(expected, 'hex'); + const receivedBuf = Buffer.from(signatureHeader, 'hex'); + + if (expectedBuf.length !== receivedBuf.length) return false; + + return crypto.timingSafeEqual(expectedBuf, receivedBuf); +}