[Bug]: Validation of the webhook not working

[rohittiwari-dev]

I used both the methods below mention and have encountered that what ever i try i am i getting unverified

i printed the custom signature generated it is resulting in some other signature than in the headers of the webhook call

export default async function handler(req, res) {
  const secret = process.env.RAZORPAY_WEBHOOK_SECRET;
  const signature = req.headers['x-razorpay-signature'];
  const body = JSON.stringify(req.body);

  // Verify webhook signature
  const generated_signature = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');

  if (generated_signature === signature) {
    const event = req.body.event;
    if (event === 'payment.captured') {
      const payment = req.body.payload.payment.entity;
      const paymentId = payment.id;
      const orderId = payment.order_id;
      // Update order status in your database
      // e.g., markOrderAsPaid(orderId, paymentId);
    }
    res.status(200).json({ status: 'success' });
  } else {
    res.status(400).json({ status: 'verification_failed' });
  }
}

and also

 const signature =
            (req.headers["x-razorpay-signature"] as string) ||
            (req.headers["X-Razorpay-Signature"] as string);

        const secrets = process.env.RAZORPAY_WEBHOOK_SECRET_KEY as string;
        if (!signature || !secrets) {
            throw new BadRequest(
                "Unverified Payment Details Received. Omitted Adding Subscriptions"
            );
        }
        if (
            !validateWebhookSignature(
                JSON.stringify(req.body),
                signature,
                secrets
            )
        ) {
            throw new BadRequest(
                "Unverified Payment Details Received. Omitted Adding Subscriptions"
            );
        }

in both the ways i am getting different signature in webhook header then i am creating expected signature and the function razopay is giving is also returning false in this particular case

can some one help me out if i am doing wrong

[hansdaapurba]

I used both the methods below mention and have encountered that what ever i try i am i getting unverified

i printed the custom signature generated it is resulting in some other signature than in the headers of the webhook call

export default async function handler(req, res) {
const secret = process.env.RAZORPAY_WEBHOOK_SECRET;
const signature = req.headers['x-razorpay-signature'];
const body = JSON.stringify(req.body);

// Verify webhook signature
const generated_signature = crypto
.createHmac('sha256', secret)
.update(body)
.digest('hex');

if (generated_signature === signature) {
const event = req.body.event;
if (event === 'payment.captured') {
const payment = req.body.payload.payment.entity;
const paymentId = payment.id;
const orderId = payment.order_id;
// Update order status in your database
// e.g., markOrderAsPaid(orderId, paymentId);
}
res.status(200).json({ status: 'success' });
} else {
res.status(400).json({ status: 'verification_failed' });
}
}
and also

const signature =
(req.headers["x-razorpay-signature"] as string) ||
(req.headers["X-Razorpay-Signature"] as string);

    const secrets = process.env.RAZORPAY_WEBHOOK_SECRET_KEY as string;
    if (!signature || !secrets) {
        throw new BadRequest(
            "Unverified Payment Details Received. Omitted Adding Subscriptions"
        );
    }
    if (
        !validateWebhookSignature(
            JSON.stringify(req.body),
            signature,
            secrets
        )
    ) {
        throw new BadRequest(
            "Unverified Payment Details Received. Omitted Adding Subscriptions"
        );
    }

in both the ways i am getting different signature in webhook header then i am creating expected signature and the function razopay is giving is also returning false in this particular case

can some one help me out if i am doing wrong

Are you using appropriate parsers?

[rohittiwari-dev]

I used both the methods below mention and have encountered that what ever i try i am i getting unverified
i printed the custom signature generated it is resulting in some other signature than in the headers of the webhook call
export default async function handler(req, res) {
const secret = process.env.RAZORPAY_WEBHOOK_SECRET;
const signature = req.headers['x-razorpay-signature'];
const body = JSON.stringify(req.body);
// Verify webhook signature
const generated_signature = crypto
.createHmac('sha256', secret)
.update(body)
.digest('hex');
if (generated_signature === signature) {
const event = req.body.event;
if (event === 'payment.captured') {
const payment = req.body.payload.payment.entity;
const paymentId = payment.id;
const orderId = payment.order_id;
// Update order status in your database
// e.g., markOrderAsPaid(orderId, paymentId);
}
res.status(200).json({ status: 'success' });
} else {
res.status(400).json({ status: 'verification_failed' });
}
}
and also
const signature =
(req.headers["x-razorpay-signature"] as string) ||
(req.headers["X-Razorpay-Signature"] as string);

    const secrets = process.env.RAZORPAY_WEBHOOK_SECRET_KEY as string;
    if (!signature || !secrets) {
        throw new BadRequest(
            "Unverified Payment Details Received. Omitted Adding Subscriptions"
        );
    }
    if (
        !validateWebhookSignature(
            JSON.stringify(req.body),
            signature,
            secrets
        )
    ) {
        throw new BadRequest(
            "Unverified Payment Details Received. Omitted Adding Subscriptions"
        );
    }

in both the ways i am getting different signature in webhook header then i am creating expected signature and the function razopay is giving is also returning false in this particular case
can some one help me out if i am doing wrong

Are you using appropriate parsers?

yes inbuilt body parser of express

[hansdaapurba]

@rohittiwari-dev
Here you go:
const generated_signature = crypto .createHmac('sha256', secret) .update(rzp_order_id + "|" + paymentId) .digest('hex');

I hope you can get rzp_order_id & paymentId from body.

[rohittiwari-dev]

@rohittiwari-dev Here you go: const generated_signature = crypto .createHmac('sha256', secret) .update(rzp_order_id + "|" + paymentId) .digest('hex');

I hope you can get rzp_order_id & paymentId from body.

this is for webhook ? i gues this is for payment callback and handler

anyway i figured it out, the secrets must be 64 char then it has no issue , tried and tested over multiple iterations of faliure and closing this issue

Thanks everyone