How to use signature validation

[Cyberg01]

So i've been trying to validate several payload by following the code below.

https://github.com/fbsamples/whatsapp-api-examples/blob/main/signature-validation-with-webhooks-payloads/app.py

But the signature always different with the one in x-hub-signature-256 and ending up with "INVALID SIGNATURE HASH". Fyi i am using my app-secret as Token in that code.

example of payload that i am trying to validate :

{
    "object": "whatsapp_business_account",
    "entry": [
      {
        "id": "1xxxxxxx",
        "changes": [
          {
            "value": {
              "messaging_product": "whatsapp",
              "metadata": {
                "display_phone_number": "62xxxxxx",
                "phone_number_id": "1xxxxxx"
              },
              "contacts": [
                {
                  "profile": {
                    "name": "Somebody"
                  },
                  "wa_id": "62xxxxxx"
                }
              ],
              "messages": [
                {
                  "from": "62xxxxxx",
                  "id": "wamid.example",
                  "timestamp": "1740476674",
                  "text": {
                    "body": "halo"
                  },
                  "type": "text"
                }
              ]
            },
            "field": "messages"
          }
        ]
      }
    ]
  }

[Cyberg01]

Here is the code i make that actually work using express

const crypto = require('crypto');
const express = require('express');

const app = express();
app.use(express.json());

const APP_SECRET = "your-app-secret";

const escapeUnicode = str => {
    return str.replace(/[\u00A0-\uffff]/gu, function (c) {
        return "\\u" + ("000" + c.charCodeAt().toString(16)).slice(-4)
    }).replace(/\//g, '\\/');
}

function verifySignature(req) {
    let signature = req.headers['x-hub-signature-256'];

    if (!signature) return false;

    const prefix = "sha256=";

    signature = signature.slice(prefix.length);

    let payload = JSON.stringify(req.body);

    payload = escapeUnicode(payload);

    const payloadLenght = Buffer.byteLength(payload)

    const hmac = crypto.createHmac('sha256', APP_SECRET);
    const hash = hmac.update(payload, "utf-8").digest('hex');

    console.log({ payloadLenght, payload, signature, hash })

    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(hash));
}

app.post('/webhooks', (req, res) => {
    if (!verifySignature(req)) {
        console.log("Invalid signature")
        return res.status(403).send("Invalid signature");
    }

    console.log("Received valid webhook event:", req.body);
    res.sendStatus(200);
});

app.listen(3000, () => console.log("Webhook listening on port 3000"));