#verge729-webhook-signature-node

1 messages · Page 1 of 1 (latest)

vocal raftBOT
fickle flame
#

Hi 👋

copper arch
#

👋🏽

#

I am trying to create a webhook and am getting caught on stripe.webhooks.constructEvent. The following code snippet shows what I am doing leading up to the stripe.webhooks.constructEvent, minus any try/catch blocks:

const signature = req.headers['stripe-signature'];
const req_body = JSON.stringify(req.body, null, 2)
let event;
event = stripe.webhooks.constructEvent(req_body, signature, process.env.STRIPE_TEST_WEBHOOK_SIGNATURE);

This code works for event billing_portal.session.created, but fails for all the rest.
process.env.STRIPE_TEST_WEBHOOK_SIGNATURE is the webhook secret provided by stripe listen --forward-to <webhook-endpoint>

I have researched this and tried what was recommended in forums and Stripe documentation, but nothing has worked so far

fickle flame
#

Well the JSON.stringify should fail for all of them

#

The .contructEvent method expects the raw body

#

Not even a string, it should be something like <Buffer 32 45 12 ...

copper arch
#

Not having the JSON.stringify results in them all failing

fickle flame
#

That likely means the request body is being transformed before it reaches your webhook code

#

try logging it before you stringify. If you see JSON then your Node.js framework is doing something it shouldn't

copper arch
#

trying that now

fickle flame
#

Also if you see [Object object], same problem

#

I was helping someone last week whose webhook code looked identical to our sample code but upstream from that their Node app was using something like app.use('json') or some such thing

copper arch
#

I am indeed getting JSON. and it looks like it is in a Stripe Event object form

fickle flame
#

Yeah so that won't work. Your Node.js app is transforming the request body at some point

#

As I mentioned, the hashing algorithm used to verify the event is from Stripe depends on the raw, unmodified, request body

copper arch
#

@fickle flame where is the documentation for .constructEvent?

#

My searches have come up empty

fickle flame
#

well .constructEvent is part of the Node JS client library which is available on Github so you can review it there.