Code reviewMediumcr-g252

Subject Auth bypassLevel Mid–Senior~25 minCommon in Security interviewsIndustries Software development

Question

Review this Node.js webhook signature check.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjs

1function verifyWebhook(req) {2  const sig = req.headers['x-signature'];3  const expected = crypto4    .createHmac('sha256', SECRET)5    .update(req.rawBody)6    .digest('hex');7  if (sig === expected) {8    return true;9  }10  return false;11}

Run or narrate your approach, then ask the coach.