Protect webhook with `X-Webhook-Secret`

server.ts

@@ -1,12 +1,18 @@
 import * as express from "express";
 
-const expressApp = express();
+const app = express();
+// parse HTTP request bodies as json
+app.use(express.json());
 
-expressApp.get("/", (req, res) => {
+app.get("/", (req, res) => {
 	res.json({ hello: "world" });
 });
 
-expressApp.post("/", (req, res) => {
+app.post("/", (req, res) => {
+
+	if (req.header("X-Webhook-Secret") !== process.env.WEBHOOK_SECRET) {
+		return res.status(400).json({ error: "incorrect secret" });
+	}
 	console.log(req.body);
 
 	res.json({ success: true });
@@ -14,6 +20,6 @@ expressApp.post("/", (req, res) => {
 
 
 const PORT = 7860;
-expressApp.listen(PORT, () => {
+app.listen(PORT, () => {
 	console.debug(`server started at http://localhost:${PORT}`);
 });