Self HostedWebhooks

Webhook verification

Aug 31, 2024, 02:00

View on Discord

Votes

Replies

Participants

Unknown

Messages

f4ls3Original post

Web Developer

Aug 31, 2024, 01:29

So Im trying to verify my webhooks like stated in the docs but I weirdly get it to work on one webhook but not on two others.

My middleware code is this:

TypeScript

app.use((req, res, next) => {
    logger.info(`${req.method} ${req.originalUrl} | ${req.ip}`);

    if (!req.ip) return res.status(401).json({message: 'Unauthorized'});

    const requestIp = req.ip.replace('::ffff:', '');
    if (requestIp !== process.env.AUTHORIZED_IP) return res.status(401).json({message: 'Unauthorized'});
    console.log('made it 1')

    const signatureHeader = req.headers['x-appwrite-webhook-signature'];
    const userAgent = req.headers["user-agent"];
    const token = generateWebhookSignature(req.body, `${req.protocol}://${req.get("host")}${req.originalUrl}`);

    console.log(token)
    console.log(signatureHeader)

    if (!userAgent || !userAgent.startsWith('Appwrite-Server')) return res.status(401).json({message: 'Unauthorized'});
    console.log('made it 2')
    if (!signatureHeader || signatureHeader !== token) return res.status(401).json({message: 'Unauthorized'});
    console.log('made it 3')
    next();
})

TypeScript

export const generateWebhookSignature = (payload: any, url: string) => {
    console.log(url + JSON.stringify(payload))

    return crypto
        .createHmac("sha1", process.env.APPWRITE_SIG_KEY || "")
        .update(url + JSON.stringify(payload))
        .digest("base64");
};

As I said weirdly enough this generates the correct signature when a webhook is received by a document creation in my database but it generates different signatures when a document is deleted/updated and thus "fails" to authorize. Am I doing something wrong?

Summary

Developers are facing issues with webhook verification for different events. The signature generated does not match for document deletion and update, causing authorization to fail. Ensure that the payload includes all necessary data and is consistent for all events to generate the correct signature.

f4ls3

Web Developer

Aug 31, 2024, 01:31

These are the webhooks:

TypeScript

import {Router} from 'express';

const router = Router();

router.post('/database/events/create', (req, res) => {
    console.log("create")
    res.status(200).send({ success: true });
});

router.post('/database/events/update', (req, res) => {
    console.log("update")
    res.status(200).send({ success: true });
});

router.post('/database/events/delete', (req, res) => {
    console.log("delete")
    res.status(200).send({ success: true });
});

export default router;

Webhook verification

Need support?_