Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ConstructEvent Webhook #494

Closed
MatheusAlvesSouza opened this issue Sep 4, 2018 · 1 comment
Closed

ConstructEvent Webhook #494

MatheusAlvesSouza opened this issue Sep 4, 2018 · 1 comment

Comments

@MatheusAlvesSouza
Copy link

Node version : 8.11.3
Stripe version : 6.7.0

I'm having a problem with the validation request from webhook. My application has a parse middleware to JSON with the lib body-parser :

const bodyParser = require('body-parser')
const app = express()

app.use(bodyParser.urlencoded({ extended: false }))
app.use(bodyParser.json())

And when I'll use the function:

const stripe = require('stripe')(SK);`
stripe.webhooks.constructEvent( JSON.stringify( req.body ) , req.headers['stripe-signature'], KEY );

The validation throw an exeption with a validation error message:

Error: No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe? https://github.com/stripe/stripe-node#webhook-signing

However if I exclude the parse middleware ( bodyParser.json()) from my api, the validation method is successful. But I can't remove this middleware of my application because it'll change all my project structure.

@remi-stripe
Copy link
Contributor

@MatheusAlvesSouza there have been multiple issue threads discussing this before which might help, especially this one: #341

Often, it's due to your own tooling parsing the JSON when we actively require that you use the raw JSON from the body without any parsing or encoding on top of it.

Your code right now takes the parsed JSON and stringify it. Which means the JSON you generate is different from the one we sent you, even if just by one space, which means the signatures don't match,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants