Add logic to verify webhook calls

[andypiper]

The API provides an x-twitter-webhooks-signature header for validating calls. We should add this to the example for completeness.

https://developer.twitter.com/en/docs/accounts-and-users/subscribe-account-activity/guides/securing-webhooks

[peterpoliwoda]

Hi Andy you make a valid point. The description in the documentation is a bit vague, I'd like to understand what it means to Create a hash using your consumer secret and incoming payload body exactly. The x-twitter-webhooks-signature header is quite short. If I add together my twitter secret and the body payload it'll be a very long base64 hash. Could you give an example of how to get this?

Optional signature header validation
With each incoming POST request from Twitter, a hash signature will be passed in the headers as x-twitter-webhooks-signature. This signature can be used to validate the source of the data is Twitter. The hash signature starts with sha256=indicating the use of HMAC SHA-256 to encrypt your Twitter app Consumer Secret and payload.

Steps to validate a request

Create a hash using your consumer secret and incoming payload body.
Compare created hash with the base64 encoded x-twitter-webhooks-signature value. Use a method like compare_digest to reduce the vulnerability to timing attacks.

[steffes]

https://twittercommunity.com/t/validating-the-webhook-signature-header-in-node-js/102525