const FB_APP_SECRET = 'your facebook app secret';

// requires
const crypto = require('crypto');

const verifyXHubSignature = req => {
    const digest = crypto
    .createHmac('sha1', FB_APP_SECRET)
    .update(req.rawBody)
    .digest('hex');
    return req.headers['x-hub-signature'] === `sha1=${digest}`;
};