Self-Hosting Meta WhatsApp Webhooks
HMAC-SHA256 Security, Redis Deduplication & Zero SaaS Fees

1. CRYPTOGRAPHIC SIGNATURE VERIFICATION (HMAC-SHA256)

Every inbound POST request from Meta includes an X-Hub-Signature-256 header containing an HMAC-SHA256 hash calculated with your Meta App Secret. We verify this using constant-time buffer comparison to prevent timing attacks and unauthorized request spoofing:

const crypto = require('crypto');

function verifyMetaSignature(req, res, buf) {
  const signature = req.headers['x-hub-signature-256'];
  if (!signature) throw new Error('Missing signature header');
  
  const expectedHash = 'sha256=' + crypto
    .createHmac('sha256', process.env.META_APP_SECRET)
    .update(buf)
    .digest('hex');
    
  const signatureBuffer = Buffer.from(signature, 'utf8');
  const expectedBuffer = Buffer.from(expectedHash, 'utf8');
  
  if (signatureBuffer.length !== expectedBuffer.length || 
      !crypto.timingSafeEqual(signatureBuffer, expectedBuffer)) {
    throw new Error('Invalid HMAC-SHA256 payload signature');
  }
}

2. REDIS IDEMPOTENCY & DEDUPLICATION

Meta's webhook infrastructure retries delivery if your server takes longer than 5 seconds or encounters transient packet loss. Under burst traffic, duplicate deliveries can cause double appointment bookings or duplicate order confirmations. We enforce idempotency using Redis distributed locks:

// Extract unique Meta message ID
const messageId = body.entry[0]?.changes[0]?.value?.messages[0]?.id;

// Atomic lock with 60-second TTL
const isNew = await redis.set(`msg_lock:${messageId}`, '1', 'EX', 60, 'NX');
if (!isNew) {
  // Duplicate delivery from Meta retry — acknowledge immediately
  return res.status(200).send('EVENT_ALREADY_PROCESSED');
}

3. ASYNCHRONOUS BACKGROUND WORKER DISPATCH

Never run heavy AI LLM inferences, database transactions, or external CRM API syncs inside the active webhook request cycle. We acknowledge Meta with an immediate HTTP 200 within 85ms and enqueue the message into a worker queue (BullMQ / RabbitMQ) for background processing.