Strapi raw body to comply with Stripe constructEvent

[lambertkevin]

Describe the bug
As I was playing with the Stripe webhooks api, it appears that I can't use the constructEvent method because I can't get the raw request body from strapi. A similar issue existed with Express and was resolved by using body-parser middleware but I can't figure out the strapi equivalent.

Steps to reproduce the behavior

1. Install the stripe cli
2. Create a simple hook in you strapi app
3. Start forwarding to your strapi app the events from the stripe-cli (eg: stripe listen --forward-to localhost:1337/hook)
4. Launch an event with your stripe cli (e.g.: stripe trigger payment_intent.created)
5. See error ( Error: No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe? https://github.com/stripe/stripe-node#webhook-signing

Expected behavior
I should be able to get a correct constructEvent result by parsing the body of my request.

Screenshots

Code snippets
My hook:

  hook: async (ctx) => {
    const body = JSON.stringify(ctx.request.body);
    const endpointSecret = 'whsec_secret';
    const signature = ctx.request.headers['stripe-signature'];

    const event = stripe.webhooks.constructEvent(body, signature, endpointSecret);
    console.log(event)
}

System

• Node.js version: 11.12.0
• NPM version: 6.7.0
• Strapi version: 3.0.0-beta.17.8
• Database: postgres
• Operating system: MacOS

Ideas
As said before, stripe is giving an example for Express here which solves the issue by using bodyParser.raw({type: 'application/json'}) as a middleware for this route.

[lambertkevin]

Ok found a solution after a LOT of time 😆

You have to modify all your request.json files to add a parameter to the koa-body parser.

"parser": {
    "enabled": true,
    "multipart": true,
    "includeUnparsed": true
  }

includeUnparsed will add a symbol containing the unparsed body in ctx.request.body.

To get this symbol you'll have to import const unparsed = require('koa-body/unparsed.js');and then ctx.request.body[unparsed] will contain the raw buffer of the body.

const unparsed = require('koa-body/unparsed.js'); 
...
  hook: async (ctx) => {
    const endpointSecret = 'whsec_secret';
    const signature = ctx.request.headers['stripe-signature'];
    const event = stripe.webhooks.constructEvent(ctx.request.body[unparsed], signature, endpointSecret);
}

[lauriejim]

So you are okay with your issue.
We can close it I think.

[derrickmehaffy]

I will mark as closed as user found resolution to their issue.

[olso]

Maybe this will help someone in the future stripe/stripe-node#396 (comment)

[collegewap]

Here is what worked for me

Create a middleware (/config/middleware.js) and update it to the following

module.exports = {
  settings: {
    cors: {
      enabled: true,
    },
    parser: {
      enabled: true,
      multipart: true,
      includeUnparsed: true,
    },
  },
};

In the controller (/api//controllers/.js):

const unparsed = require("koa-body/unparsed.js");
const unparsedBody = ctx.request.body[unparsed];

[okwme]

@collegewap I dont see includeUnparsed as a valid option in the strapi documentation. When I try your method I don't see it in the body object either. Any idea what could be different on my setup?

[okwme]

nm i figured it out, had middleware.js in the wrong config directory 🤦‍♂️

[nazrdogan]

I had the same issue with v4. I changed middleware.js like this. it may help anyone have same issue.

module.exports = [
  "strapi::errors",
  "strapi::security",
  "strapi::cors",
  "strapi::poweredBy",
  "strapi::logger",
  "strapi::query",
  {
    name: "strapi::body",
    config: {
      includeUnparsed: true,
    },
  },
  "strapi::session",
  "strapi::favicon",
  "strapi::public",
];

[callum-gander]

I'm also having this issue with v4 but none of the solutions seem to be working. I need the raw request for Xero, not Stripe, but the same principles apply. Added correctly to config, see below

config: {
            multipart: true,
            patchKoa: true,
            textLimit: 10737418240,
            formLimit: 10737418240,
            jsonLimit: 10737418240,
            includeUnparsed: true,
            formidable: {
                maxFileSize: 10737418240, // files can be up to 1000mb
            },
        },

Then tried accessing the raw body with ctx.request.body[unparsed] with both const unparsed = require("koa-body/unparsed.js"); as well as the Symbol method, but still no dice. Completely baffled as to why the raw request is just not accessible, completely inhibiting my ability to build a crucial part of our infrastructure, anyone have any ideas or suggestions beyond those above as to why this isn't working?

[dam-ion]

@callum-gander I am still running into the same issue as well. includeUnparsed doesn't seem to work. Did you figure it out?

[MarkusAbtion]

Same here. It worked until recently.
I can still see an unparsed body, but according to Stripe it's not the actual unparsed request 🤷

@derrickmehaffy Would it make sense to reopen?