topic How to verify webhook notification in nodejs in Integration and Testing

How to verify webhook notification in nodejs

nan40411 — Thu, 25 May 2023 21:13:20 GMT

Hello,

I found this post https://community.developer.cybersource.com/t5/Integration-and-Testing/Verify-WebHook-Notifications-example/m-p/63889#M37908, I replied there but it marked "Solved" and no one continue to reply it, so I would like to ask here. I am sorry if it is inconvenient because of my action. I try to verify the notifications but my code just doesn't work. Here is the code

const crypto = require('crypto');

app.post("/authorize/payment/created", (req, res)=> {

const hash = crypto.createHmac('sha512', signature_key)

.update(JSON.stringify(req.body))

.digest('hex')

.toUpperCase();

if ("sha512="+hash != req.headers["x-anet-signature"]) {

console.log({

result: false,

header: req.headers["x-anet-signature"],

hash

})

// do something

return;

}

// do something

});

Please give me a guidance

Re: How to verify webhook notification in nodejs

nan40411 — Wed, 31 May 2023 20:08:22 GMT

Hello,

Thank you very much for the reply. So in a way, the code I posted was correct? We generated new signature key so the key should be correct. I logged all the payload and sometimes it matches and sometimes it doesn't

Re: How to verify webhook notification in nodejs

sera_nikulin — Sat, 16 Dec 2023 01:15:10 GMT

Hey @nan40411

If it randomly matches and sometimes it doesn't - then probably you faced with the same issues as I.
Auth.net create a signature with authAmount #.## format (2 digits after period) but send in webhook in another format (for example 2 or 2.1) Try change manually authAmount to 2.00 or 2.10 - then you'll have valid signature.