Skip to main content
Solved

Webhook Signing Issue

  • 24 March 2023
  • 1 reply
  • 70 views

Looks like we’re having issues with a subset of our webhook requests which have emoji’s in the body.

We’ve tested bodies without and the encryption method we have works.


def is_valid_cio_webhook_request(xcio_signature: str,
                                 xcio_timestamp: int,
                                 body_bytes: bytes,
                                 webhook_signing_secret: str = CUSTOMERIO_API_WEBHOOK_SIGNING_KEY
                                 ) -> bool:


    signature = codecs.decode(xcio_signature, 'hex')
    message = f"v0:{xcio_timestamp}:"
    mac = hmac.new(bytes(webhook_signing_secret, 'utf-8'), msg=message.encode('utf-8'), digestmod=hashlib.sha256)
    mac.update(body_bytes)
    computed = mac.digest()
    if not hmac.compare_digest(computed, signature):
        logging.debug("Signature didn't match")
        return False
    logging.debug("Signature matched!")
    return True

 

Solution found: the bytes string being passed in wasnt correct:

When converting the dict to bytestring we needed to add ensure_ascii=False for it to work with emojis.

json.dumps(request_body, separators=(',', ':'), ensure_ascii=False).encode('utf-8')

Reply


Terms & ConditionsCookie settings