You echo it out like you would HTML on a webpage.
Just instead of sending HTML you send just the challenge.
No, no headers are required.
Express just spits it out like if you were sending HTML/using express to serve a website
So
res.send('<html><head><title>My WebPage</title></head><body><p>My cool website</p></html>');
Is the same as
res.send(the_challenge);
encodeURIComponent used to help combat CWE-79/CWE-116 against Cross Site Scripting (this commit CWE-79/CWE-116 advice for Cross Site Scripting. · BarryCarlyon/twitch_misc@926de5a · GitHub )
In express res.send replies to the inbound HTTP Request for “gimmie this webpage” just for this request for eventsub it’s just the challenge you spit out and not a full webpage