What is payload_body in verifyGatewaySignature function?

API Support
1

I implemented webhook verfication looking at

that is
var verifyGatewaySignature = function(proposed_signature, webhook_secret, payload_body) {
var crypto = require('crypto');

var hash = crypto.createHmac('sha256', webhook_secret).update(payload_body).digest('hex');

return proposed_signature === hash;
}

but I could not figure out what exactly is payload_body from documentation therefore getting wrong hash value.

I am having hard time trying to figure out correct argument for the verifyGatewaytSignature function.
I call the function using these argument right now but hash result is different from that is from req.headers[‘x-request-signature-sha-256’].

Right now I use webhook secret and payload_body.body.id to supply createHmac but I could not figure out what exactly is payload_body from documentation.

I call the function with these parameter from api router:
if(!dwollaClient.verifyGatewaySignature(req.headers['x-request-signature-sha-256'],'your webhook secret', req))

exports.verifyGatewaySignature=function(proposed_signature,webhook_secret,payload_body) {
var crypto = require('crypto');
var hash = crypto.createHmac('sha256',webhook_secret).update(payload_body.body.id).digest('hex')
return proposed_signature === hash; }

Webhook subscription requestbody:
var requestBody = { url: ' https://lazy-fish.localtunnel.me', secret: 'your webhook secret' };

2

Hi, thank you for your question.

Are you passing in the raw HTTP request body that Dwolla sends? The webhook payload will be JSON encoded and shouldn’t be re-encoded. You’ll just need to pass in the raw JSON body ‘payload_body’, and not just the id ‘payload_body.body.id’.

Here is an example of what the webhook payload looks like: https://developers.dwolla.com/guides/webhooks/#example-webhook-payload

We would be happy to help you with any more questions.

1 Like
3

For those who want to use it as a middleware, here is the function:

const verifyGatewaySignature = (req, res, next) => {
	const proposed_signature = req.headers['x-request-signature-sha-256'];
	const hash = crypto
		.createHmac('sha256', 'your-secret')
		.update(bufferFrom(JSON.stringify(req.body)))
		.digest('hex');

	const valid = crypto.timingSafeEqual(bufferFrom(proposed_signature), bufferFrom(hash));

	if (!valid) {
		return res.status(401).jsonp({
			error: 'Invalid signature',
		});
	}

	next();
};
2 Likes
4

Thanks for your contribution, @valentin.constanda !

5

This does not answer the question. Could you please explain exactly what the payload_body variable is supposed to be? is it req.body? Is it an element inside body? is it from some other header? ???

verifyGatewaySignature(proposed_signature, webhook_secret, payload_body)
6

So the answer to this is the docs do not remind you to stringify the req.body. So it should look like this:

const payload_body = JSON.stringify(req.body);
7

Hi @Adam_Braus1 – the webhook payload body is JSON-encoded and shouldn’t need be manipulated or decoded. I’d be intrigued to know if stringifying it worked for you. Let me know!