Webhook signature mismatch - secret and body checked

vikaspotluri123 · November 25, 2024, 9:17pm

You’re missing the timestamp from the body, here are a couple of related threads:

And here’s how I implemented verification a couple weeks ago:

vikaspotluri123/discourse-on-ghost/blob/74f3a32a12d33bb50d898f070930314faba6a650/src/controllers/ghost-webhook.ts#L121-L188


      
          	private async verifyWebhook(secret: MaybeKey, request: Request, response: Response) {
          		if (!secret) {
          			return true;
          		}
          
          		const signature = request.headers['x-ghost-signature'];
          		if (!signature || typeof signature !== 'string') {
          			response.status(400).json({message: 'Missing signature'});
          			return false;
          		}
          
          		const unsafeParsedSignature = parseSignature(signature);
          
          		// eslint-disable-next-line prefer-object-has-own
          		if (!Object.hasOwnProperty.call(unsafeParsedSignature, 'sha256') || !Object.hasOwnProperty.call(unsafeParsedSignature, 't')) {
          			response.status(400).json({message: 'Invalid signature'});
          			return false;
          		}
          
          		const {t: timestamp, sha256} = unsafeParsedSignature as Record<'sha256' | 't', string>;

This file has been truncated. show original

Topic		Replies	Views
Wehbook validation, in phython Using Ghost	2	71	August 25, 2024
Issue Title: Unable to Verify Ghost Event Using Webhook Using Ghost	17	839	December 12, 2024
Customizing webhook Developer help	0	265	March 9, 2021
Calculating sha256 for Ghost webhook Developer help	2	313	January 25, 2024
I have problem with webhooks Developer help	3	601	March 13, 2019

Webhook signature mismatch - secret and body checked

Related topics