Getting Invalid signature on incoming request with botBuilder adapter for Facebook - node.js

Question

I have successfully deployed this example repo to azure and it is now working in the web chat and on slack.
Now I'm trying to use the facebook adapter in my bot. I have followed the instructions to use FacebookAdapter with BotBuilder and added the following code into index.js
const { FacebookAdapter } = require('botbuilder-adapter-facebook');
const restify = require('restify');
const adapter = new FacebookAdapter({
verify_token: process.env.FACEBOOK_VERIFY_TOKEN,
app_secret: process.env.FACEBOOK_APP_SECRET,
access_token: process.env.FACEBOOK_ACCESS_TOKEN
});
const server = restify.createServer();
server.use(restify.plugins.bodyParser());
server.use(restify.plugins.queryParser());
server.get('/api/messages', (req, res) => {
if (req.query['hub.mode'] === 'subscribe') {
if (req.query['hub.verify_token'] === process.env.FACEBOOK_VERIFY_TOKEN) {
const val = req.query['hub.challenge'];
res.sendRaw(200, val);
} else {
console.log('failed to verify endpoint');
res.send('OK');
}
}
});
server.post('/api/messages', (req, res) => {
adapter.processActivity(req, res, async(context) => {
await context.sendActivity('I heard a message!');
});
});
server.listen(process.env.port || process.env.PORT || 3000, () => {
console.log(`\n${ server.name } listening to ${ server.url }`);
});
also in my .env file I have added the various tokens and secrets required.
When I try testing the app locally with bot framework emulator I get the error
(node:11588) UnhandledPromiseRejectionWarning: Error: Invalid signature on incoming request
at FacebookAdapter.<anonymous> (/home/ronald/Desktop/03.welcome-users/node_modules/botbuilder-adapter-facebook/lib/facebook_adapter.js:421:23)
at Generator.next (<anonymous>)
at /home/ronald/Desktop/03.welcome-users/node_modules/botbuilder-adapter-facebook/lib/facebook_adapter.js:15:71
I'm not sure what I'm doing wrong

Answer 1

Unfortunately, this appears to be a bug of some variety. An issue already exists on the Botkit Github repo with various customers experiencing a similar problem, however there is no fix at this time. It seemingly doesn't affect all customers, as the Botkit developer (at the time of his posting) was able to use the adapter without error.
In looking into your problem, I was able to determine that the error is generated from the verifySignature() method in the FacebookAdapter class. There should be an "x-hub-signature" header returned from Facebook which is used to check the signature of the request payload for the webhook event. For unknown reasons, this header is missing which results in the "invalid signature" message.
I would recommend you comment on the above GH issue to help facilitate work on the problem.
Hope of help!
-----EDIT-----
The Facebook Adapter is designed to work independently of the Azure Bot Service / ABS Channels, even when integrated with a BotFramework bot. As such, it will not work with BotFramework Emulator. It is designed to connect directly to the bot's adapter.
This also means you need to adjust the Webhook Callback URL in your Facebook app settings to point to your locally running bot. The webhook value, when configured for ABS looks something like:
https://facebook.botframework.com/api/v1/bots/[botname].
You will want to adjust it to point to your ngrok endpoint (used for tunneling between your local bot and external sources like Facebook). The new webhook value would look something like this:
https://1a04e4ad.ngrok.io/api/messages.
Don't forget to include the verify token which also comes from Facebook (found in the settings).
Assuming you've changed the webhook url, supplied the verify token, and are NOT using Emulator, then it should work seemlessly.
Note: Facebook sends echos and delivery confirmations for every event passed. The result is, if you don't filter on incoming event types or turn off additional events in Facebook, then your bot will be hit continuously.