QuickAlerts Help!

Question

I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a hacker/scammer? - Tien

Answer 1

Each QuickAlerts WebHook payload has a unique set of signatures, using which you can verify if the payload is trusted.

Here's an example in JavaScript to verify signature in the payload:

const crypto = require('crypto');

const secret = 'your_security_token';
const givenSign = req.headers['x-qn-signature'];
const nonce = req.headers['x-qn-nonce'];
const contentHash = req.headers['x-qn-content-hash'];
const timestamp = req.headers['x-qn-timestamp'];

const hmac = crypto.createHmac('sha256', secret);
hmac.update(nonce + contentHash + timestamp);

const expectedSign = hmac.digest('base64');

if (givenSign === expectedSign) {
  console.log('The signature given matches the expected signature and is valid.');
} else {
  console.log('The signature given does not match the expected signature and is invalid.');
}

For more info on signatures and to check examples in other languages, check out docs: https://www.quicknode.com/docs/quickalerts/quickalerts-destinations/webhooks/webhook-signature