Webhook requires HMAC-SHA256 signature for verification

Hey @adamhholmes - did Bubble confirm with you that they are removing all formatting (indents etc) from the raw body? And did they say whether they were going to update this anytime soon?

They didn’t acknowledge it (although I built a whole demo app showcasing the issue) but you can see for yourself that’s what’s happening if you check the raw body text and compare it to the payload body.

and no, they didn’t give any timeline for this (I’m not convinced they even understood the issue to be honest), and bear in mind I’ve followed it up 3 times already this year, to the same generic response, I wouldn’t expect it any time soon.

2 Likes

Adam what I’m doing in my app is taking the json request, “prettifying” it manually and then comparing it the another “prettified” version of what I’m expecting.

In reality, it’s pointless to check for syntax- what’s important is wether the information passed along is correct or not. So just force the formatting as you wish and the problem is solved.

I’m using custom js to do this, but another way to do it is to create an arbitrary text and build the JSON yourself. That’s another way to force the formatting you’re expecting. I’m using both ways in my app and they work fine.

Are you doing that with Stripe?

I’m doing it with Plaid. For stripe integration, I have created a function inside of a plug-in that does everything for you (comes with node fetch and everything)

The same thing applies though

Hi! @adamhholmes @jonah.deleseleuc @MattN I’m trying to dynamically sign a POST call with the raw json body of the actual request.

How would I go about doing this?

I’m having a hard time actually getting the JSON body.
Not the returned values of success / failure as that what comes up with “raw body text” but the actual api input JSON body…

Any ideas?

You pass that body in to the request yourself so why can’t you store it?

Hey @jamesdevonport - how do you verify the requests from Hookdeck to Bubble (as per their docs)? Don’t you have the same problem with computing the HMAC?

For Hookdeck to Bubble I add a header with an API key to make that request secure, using a Hookdeck transformer. Happy to share the code for it if it helps!

1 Like

That would be great, thank you!