Stripe Webhook Signature Checks - Node js - IBM Functions / OpenWhisk - node.js

Question

There is some kind of encoding issue when I try to verify the signature for a Stripe Webhook. I know it’s not an issue with the Stripe package itself because I get different signatures when trying to manually hash the body data and compare the HMAC-256SHA signature with the signature from Stripe in the headers. I have tried so many different things to so many different parts, that it’s possible I have had multiple mistakes.
You’re not able to see here, but the IBM Cloud Function has been set to pass raw HTTP data, and that’s why you the decoding function being used.
The webhook is successful without verifying the signatures.
The error generated by the Stripe event function is, “No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe?”
Note: Errors are not handled correctly here while trying to debug this issue.
const stripe = require('stripe')('sk_test_********’);
var crypto = require('crypto');
// tried with the CLI secret and the one from the dashboard.
const endpointSecret = 'whsec_****’;
// Convert the stripe signature in string format to a JSON object
function sig_conversion(data){
var sig_obj = {}
var data_list = data.split(",").map((x)=>x.split("="));
var data_json = data_list.map((x)=>{sig_obj[x[0]] = x[1]})
return sig_obj
}
function decode(args) {
var decoded = new Buffer.from(args.__ow_body, 'base64')//.toString('utf-8')
return {body: decoded}
}
function main(params){
//let sig = sig_conversion(params.__ow_headers['stripe-signature']);
let sig = params.__ow_headers['stripe-signature']
let signature = sig_conversion(params.__ow_headers['stripe-signature']);
//console.log(222, signature);
var data = decode(params);
let event;
// Trying to see the result from manually checking the signatures.
var signed_payload = data.body + "." + signature.t
var hmac = crypto.createHmac('sha256', endpointSecret);
var hmac_sig = hmac.update(signed_payload);
var gen_hmac= hmac_sig.digest('hex');
console.log(gen_hmac, 222, signature, 444)
try {
event = stripe.webhooks.constructEvent(JSON.parse(data.body), sig, endpointSecret);
//event = JSON.parse(data.body);
}

Answer 1

Here are some steps to help people trying the same thing (some of the steps are general steps not directly related to the problem from above).
Ensure that web actions are enabled under the Endpoints menu.
Check the option for Raw HTTP handling under the same screen (Most of the documentation you will see is in relation to using Node.js + Express. The error that people experience in Express is the same, which is that the raw signature data in the header and the body data is needed for the verifying the signature. This applies to regardless of whether you are using Stripe’s package or manually verifying the signatures.)
Process the body data from ‘base64’ encoding.
If the endpoint secret from the Stripe CLI tool doesn’t work, try the one from the dashboard; and vice-versa.
Note: People using Google Cloud Functions or Pub-sub will likely have similar issues with signature verification.
function decode(args) {
var decoded = new Buffer.from(args.__ow_body, 'base64')
return {body: decoded}
}
// Match the raw body to content type application/json
function main(params){
let sig = params.__ow_headers['stripe-signature']
var data = decode(params);
let event;
try {
event = stripe.webhooks.constructEvent(data.body, sig, endpointSecret);
}
// The rest is the same as the stripe boilerplate code.
catch (err) {
return {
body: {payload:''},
statusCode:200,
headers:{ 'Content-Type': 'application/json'}
};
}
// Handle the event
switch (event.type) {
case 'payment_intent.succeeded':
const paymentIntent = event.data.object;
console.log('PaymentIntent was successful!')
break;
case 'payment_method.attached':
const paymentMethod = event.data.object;
console.log('PaymentMethod was attached to a Customer!')
break;
// ... handle other event types
default:
// Unexpected event type
return {
body: {payload:''},
statusCode:200,
headers:{ 'Content-Type': 'application/json'}
};
}
// Return a response to acknowledge receipt of the event
return {
body: {payload:''},
statusCode:200,
headers:{ 'Content-Type': 'application/json'}
};
};