How to validate HMAC the shopify webhook - nodejs Lambda - node.js

Question

I cannot able to validate the webhook response from the shopify by using the "crypto-js" package.
i am using: "Node.js, AWS-Lambda , crypto-js" and the following code to validate
var CryptoJS = require("crypto-js");
var getRawBody = require("raw-body");
var Buffer = require('buffer/').Buffer // note: the trailing slash is important!
exports.handler = async (event, context) => {
let hmac = event.hmac;
const bodyString = Buffer.from(event.body, "utf8").toString();
var bodyForVerification = bodyString.replace('/\\/g', '\\\\');
let firma = CryptoJS.HmacSHA256(bodyForVerification, "****");
var hashInBase64 = CryptoJS.enc.Base64.stringify(firma);
let calculatedHmacBase = hashInBase64.toString(CryptoJS.enc.hex);
if(hmac == calculatedHmacBase {
console.log("verificado");
}
};
The HMAC is different..

Answer 1

I use this middleware for my public and private apps on Shopify,
using crypto, it is deprecated but works fine for my code.
const crypto = require('crypto');
const verify = function (req, res, next) {
if (req.query.shop) {
if (!req.query.signature) {
return false;
}
console.log(req.query);
const signature = req.query.signature;
const sharedSecret = process.env.SHOPIFY_SHARED_SECRET;
const def = req.query;
delete def.signature;
const sortedQuery = Object.keys(def).map(key => `${key}=${Array(def[key]).join(',')}`).sort().join('');;
const calculatedSignature = crypto.createHmac('sha256', sharedSecret).update(sortedQuery).digest('hex');
if (calculatedSignature === signature) {
console.log('validated');
return next();
}
console.log('not validated');
return false;
}
};
module.exports = verify;