Skip to content

Fix webhook signature verification raw body handling#216

Open
sravan27 wants to merge 2 commits into
FX-GENE:mainfrom
sravan27:sravan/hmac-raw-body-verification
Open

Fix webhook signature verification raw body handling#216
sravan27 wants to merge 2 commits into
FX-GENE:mainfrom
sravan27:sravan/hmac-raw-body-verification

Conversation

@sravan27

@sravan27 sravan27 commented Jun 6, 2026

Copy link
Copy Markdown

Closes #19.

Summary

  • sign webhook HMACs only from raw string | Buffer bodies
  • make verification fail closed for parsed/reconstructed JSON objects instead of re-serializing them
  • update merchant docs to state signatures are computed over the exact raw request body bytes
  • add focused signature regression coverage for raw strings, Buffers, parsed bodies, and rotation overlap verification

Validation

  • npm test -- --runTestsByPath src/webhooks/webhooks-signature.spec.ts src/webhooks/webhooks-deliveries.spec.ts --runInBand
  • npm run typecheck
  • npm run build
  • git diff --check

Note: local npm run lint -- --quiet src/webhooks/webhooks.service.ts src/webhooks/webhooks-signature.spec.ts is blocked because this lockfile install does not provide an eslint binary (sh: eslint: command not found).

dreamgeneX and others added 2 commits June 5, 2026 06:00
- app.module.ts: remove duplicate AdminModule/TreasuryModule/DevModule imports,
  add missing CorrelationMiddleware import
- webhooks.service.ts: collapse three interleaved duplicate implementations
  (dispatchEvent, emitKycEvent, verifyWithRotation, rotateSecret) into
  single clean versions; remove duplicate events key in createWebhookSchema
- webhook-delivery.worker.ts: merge two interleaved deliver() bodies into one;
  fix double catch block
- invoices.service.ts: remove duplicate const result in expireInvoices()
- audit/audit.service.ts: add webhook_replayed to AuditAction type
- treasury/dto: add definite assignment assertion to signingQuorum
- test fixes: deduplicate mockAudit, add missing AppLogger mock arg,
  fix ConfigService cast, fix supertest import style
- tsconfig.json: correct ignoreDeprecations from "6.0" to "5.0"
- package.json: add supertest + @types/supertest@6 devDependencies

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Webhook HMAC signature computed with wrong encoding

2 participants