How do I compare webhook signatures without ordinary string equality?

A signature verifier should compare validated, equal-length byte sequences with an appropriate constant-time primitive. Ordinary string comparison is not designed for that purpose. Decode the expected signature format strictly, compute the MAC over the exact required bytes and use crypto.timingSafeEqual after checking lengths. Test malformed encoding, wrong length and a one-byte mismatch. Do not reserialize JSON before verification unless the provider specifies that representation. Constant-time comparison does not make surrounding parsing or key handling automatically safe. Keep secrets out of logs and reject requests whose timestamp or replay policy fails. Minimal example:

import assert from 'node:assert/strict';
import { createHmac, timingSafeEqual } from 'node:crypto';
const payload = Buffer.from('{"event":"test"}');
const expected = createHmac('sha256', 'test-key-not-a-secret').update(payload).digest();
function matches(hex) {
  if (!/^[0-9a-f]{64}$/i.test(hex)) return false;
  const candidate = Buffer.from(hex, 'hex');
  return candidate.length === expected.length && timingSafeEqual(candidate, expected);
}
assert.equal(matches(expected.toString('hex')), true);
assert.equal(matches('00'), false);
assert.equal(matches('00'.repeat(32)), false);