Webhook Delivery Failures

const express = require("express");
const app = express();

// Good: Accept immediately, process in background
app.post(
  "/webhooks/lettr",
  express.raw({ type: "application/json" }),
  (req, res) => {
    // Verify signature first
    const isValid = verifySignature(req);
    if (!isValid) {
      return res.status(401).send("Invalid signature");
    }

    // Parse and queue for background processing
    const event = JSON.parse(req.body);
    queue.add("process-webhook", event);

    // Respond immediately
    res.status(200).send("OK");
  }
);

// Bad: Processing synchronously blocks the response
app.post("/webhooks/lettr-slow", express.json(), (req, res) => {
  // This might take 30+ seconds and cause a timeout
  updateDatabase(req.body);
  sendSlackNotification(req.body);
  updateAnalytics(req.body);

  res.status(200).send("OK");
});

const crypto = require("crypto");

function verifySignature(req) {
  const signature = req.headers["lettr-signature"];
  const webhookSecret = process.env.LETTR_WEBHOOK_SECRET;

  const expectedSignature = crypto
    .createHmac("sha256", webhookSecret)
    .update(req.body) // Must be the raw body (Buffer), not parsed JSON
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

async function processWebhook(event) {
  // Check if we've already processed this event
  const exists = await db.webhookEvents.findOne({ eventId: event.id });
  if (exists) {
    console.log(`Event ${event.id} already processed, skipping`);
    return;
  }

  // Process the event
  await handleEvent(event);

  // Record that we've processed it
  await db.webhookEvents.insertOne({
    eventId: event.id,
    processedAt: new Date(),
  });
}

# Using ngrok
ngrok http 3000

# Using cloudflared
cloudflared tunnel --url http://localhost:3000