Verify Facebook X-Hub-Signature

Question

On Cloud Code on Parse Im trying to verify the header x-hub-signature received from Facebook webhook.

secret is the right secret-key of the Facebook app.

var
hmac,
expectedSignature,
payload = JSON.stringify(req.body),
secret = 'xyzxyzxyz';

hmac = crypto.createHmac('sha1', secret);
hmac.update(payload, 'utf-8');
expectedSignature = 'sha1=' + hmac.digest('hex');
console.log(expectedSignature);
console.log(req.headers['x-hub-signature']);

but the signatures never match. What is wrong?

What’s the actual contant of `payload`, after you used JSON.stringify? — CBroe, Jun 21 '16 at 15:12
the string representation of the JSON received in the body, starting with {"entry":[{"changes":[....... — GPack, Jun 21 '16 at 15:17

score 6 · Answer 1 · edited Jul 24 '20 at 21:32

Your bodyParserJSON should return rawBody:

bodyParser.json({
    verify(req, res, buf) {
      req.rawBody = buf;
    },
})

Here is a middleware that I've written. It uses crypto module to generate sha1

fbWebhookAuth: (req, res, next) => {
    const hmac = crypto.createHmac('sha1', process.env.FB_APP_SECRET);
    // hmac.update(req.rawBody, 'utf-8'); //older versions
    hmac.update(req.rawBody, 'utf8');
    if (req.headers['x-hub-signature'] === `sha1=${hmac.digest('hex')}`) next();
    else res.status(400).send('Invalid signature');
}

and finally in your route you can use it as:

app.post('/webhook/facebook', middlewares.fbWebhookAuth, facebook.webhook);

score 1 · Answer 2 · edited May 23 '17 at 12:10

1

If you're parsing the body into an object with middleware, check out Node.js - get raw request body using Express

If you're already using the raw parsing module, it should work if you don't JSON.stringify req.body:

payload = req.body,

edited May 23 '17 at 12:10

Community

1
1

answered Nov 10 '16 at 22:19

David

127
1
6

Verify Facebook X-Hub-Signature

2 Answers2