CODEWITHSUNDEEP
node.jssails.jswebhookshmacuber-api
R2 DDeux
R2 DDeux

Reputation: 11

Uber webhook signature issue with nodeJs (hmac)

I've some issues with NodeJS and an WebHook test in Uber Sandbox. I'm able to receive correcty POST response, but the security check (X-Uber-Signature) is always wrong..

module.exports = {
  myWebService: function(req, res) {
    const hmac = crypto.createHmac('sha256','<MYSECRET>');
    var hash = hmac.update(JSON.stringify(req.body)).digest('hex');

    //Those values are always different..
    console.log("Constructed hash : " + hash +"\n");
    console.log("Received hash : " + req.header('X-Uber-Signature') + "\n");

JSON.stringify(req.body) content :

{"event_id":"08db06df-559a-457a-ba92-3c8380bb7ec7","resource_href":"https://sandbox-api.uber.com/v1/requests/8f5cc257-cfdf-4654-9acd-085aae740107","meta":{"status":"arriving","rider_id":"8IMl8ulC-yJTqkbsq5g4HuyuYeRQ5b5aSsmLt2vpjl6H8Fk_JPz_5AZYj4ERi6M7MagmrJtPM7L_rAnHLgO0qLgGtpD8Lg32rnGTEUkWHAbPjDZIl0-X91PrrujPY_IYGA==","user_id":"ecb2e871-b768-4f76-bfa9-8bc253bced0e","resource_id":"8f5cc257-cfdf-4654-9acd-085aae740107"},"event_type":"all_trips.status_changed","event_time":1508163555}

I tried many (MANY) transforms on this string but nothing work, if anyone has an idea, it'll be greatly appreciated.. Thanks

Upvotes: 1

Views: 393

Answers (1)

Sasa Jovanovic
Sasa Jovanovic

Reputation: 857

Please check Uber documentation for resolution of your question:

Due to a strict interpretation of the JSON specification by JavaScript, if there are backslashes sent in the POST body, they will be removed upon parsing. This prevents webhook receivers implemented in NodeJS from verifying the webhook signature accurately. We are working on removing all backslashes from the payload in order to avoid this situation and will remove this note when that work is done.

Also, check this link.

Upvotes: 1

Related Questions