Verifying a Paystack webhook signature in Express without breaking the JSON parser

TA Tunde Adeyemi 131 il y a 3 mois Nigeria

api javascript node securite

The signature check fails every time, even with valid events. I compute an HMAC of JSON.stringify(req.body) with my secret key.

Modifiée il y a 1 heure

Thanks, this fixed it for me. · Tunde Adeyemi · il y a 3 mois
Thanks, this fixed it for me. · Koffi Kouamé · il y a 3 mois

2 réponses

Les plus utiles Les plus récentes

EH Eric Habimana 40 · il y a 3 mois Réponse acceptée

The HMAC must be computed on the raw request body, not on re-serialised JSON: key order and spacing change the bytes. Capture the raw body in the parser:

app.use(express.json({ verify: (req, res, buf) => { req.rawBody = buf; } }));

Then hash req.rawBody and compare in constant time with crypto.timingSafeEqual.

Great answer, the raw body tip saved me hours. · Esther Nyirenda · il y a 3 mois

KA Kwame Asante 50 · il y a 3 mois

Also deduplicate events by their unique reference, because webhooks can be delivered more than once.

Vous connaissez la réponse ? Rejoignez Griot pour aider.

Se connecter Rejoindre Griot