---
title: "Comment by Hayrullah Kar on \"How to Build a WhatsApp COD Order Confirmation Workflow for Shopify\" | Hashnode"
description: "Reminding readers to verify the HMAC against the raw body, before any JSON parsing, saves people a common hour of debugging. There is one trap in the snippet it"
url: "https://hashnode.com/posts/how-to-build-a-whatsapp-cod-order-confirmation-workflow-for-shopify/6ae4485d63651cef06af99b8/comment/6ae6f1367cc2fac5284d3e1c"
---

[Discussion](https://hashnode.com/posts/how-to-build-a-whatsapp-cod-order-confirmation-workflow-for-shopify/6ae4485d63651cef06af99b8)

Comment [How to Build a WhatsApp COD Order Confirmation Workflow for Shopify](https://hashnode.com/posts/how-to-build-a-whatsapp-cod-order-confirmation-workflow-for-shopify/6ae4485d63651cef06af99b8)

[Hayrullah Kar](https://hashnode.com/@magesheet)

[Nov 1](https://hashnode.com/posts/how-to-build-a-whatsapp-cod-order-confirmation-workflow-for-shopify/6ae4485d63651cef06af99b8/comment/6ae6f1367cc2fac5284d3e1c)

Reminding readers to verify the HMAC against the raw body, before any JSON parsing, saves people a common hour of debugging. There is one trap in the snippet itself. `crypto.timingSafeEqual` throws a RangeError when the two buffers have different lengths, so a request with a missing or malformed header never reaches the 401 branch. In Express 4 a rejection from an async handler is not caught for you, so that request can hang instead of being refused. Checking the lengths first and returning 401 on a mismatch fixes it. I would also move `processOrderEvent` after the response. Shopify expects a reply within a few seconds and retries otherwise, and waiting on a WhatsApp API call inside the handler is the easiest way to cause the duplicate deliveries your section 7 then has to clean up.