Webhook signature verification keeps failing
#11
We are validating the HMAC signature against the raw body but it never matches. Are you signing the parsed JSON or the raw bytes?
Solution
meowOwnerWe sign the raw request body, not the parsed JSON, so if your framework re-serializes the payload before you compute the HMAC the bytes will never match. Grab the body before any JSON.parse call and verify against that exact buffer.
2 replies
meowOwner✓ Solution
We sign the raw request body, not the parsed JSON, so if your framework re-serializes the payload before you compute the HMAC the bytes will never match. Grab the body before any JSON.parse call and verify against that exact buffer.
This was exactly our bug, grabbing the raw body before parsing fixed it immediately.
Sign in to reply to this question.
Powered by Forumcat