node.js - Stripe webhook 错误:未找到与有效负载的预期签名匹配的签名
问题描述
我正在使用 Stripe 提供的代码来测试 webhook。Stripe 密码和端点密码已经过三重检查。
条纹版本:6.19 正文解析器:1.19
当我在 Stripe 仪表板上测试 webhook 时,我得到了结果:(测试 webhook 错误:400)没有找到与有效负载的预期签名匹配的签名。您是否传递了从 Stripe 收到的原始请求正文?
任何帮助,将不胜感激。
var bodyParser - require('body-parser);
// Using Express
const app = require('express')();
app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());
// Set your secret key: remember to change this to your live secret key in production
// See your keys here: https://dashboard.stripe.com/account/apikeys
const stripe = require('stripe')('sk_test_VPw...');
// Find your endpoint's secret in your Dashboard's webhook settings
const endpointSecret = 'whsec_...';
// Use body-parser to retrieve the raw body as a buffer
const bodyParser = require('body-parser');
// Match the raw body to content type application/json
app.post('/webhook', bodyParser.raw({type: 'application/json'}), (request, response) => {
const sig = request.headers['stripe-signature'];
let event;
try {
event = stripe.webhooks.constructEvent(request.body, sig, endpointSecret); //NOT WORKING!
} catch (err) {
return response.status(400).send(`Webhook Error: ${err.message}`);
}
// Handle the checkout.session.completed event
if (event.type === 'checkout.session.completed') {
const session = event.data.object;
// Fulfill the purchase...
handleCheckoutSession(session);
}
// Return a response to acknowledge receipt of the event
response.json({received: true});
});
解决方案
通常这是由于您在检查签名之前解析或修改原始请求字符串的原因(因此签名是根据修改后的字符串计算的,而不是发送的确切的 Stripe)。在这种情况下,看起来 JSON express 中间件正在这样做:
app.use(express.json());
.
Stripe 有一个在 webhook 端点上使用原始 bodyParser 中间件的示例,以便您的代码获取所需的原始字符串:
// Use JSON parser for all non-webhook routes
app.use((req, res, next) => {
if (req.originalUrl === '/webhook') {
next();
} else {
express.json()(req, res, next);
}
});
// Stripe requires the raw body to construct the event
app.post('/webhook', express.raw({type: 'application/json'}), (req, res) => {
const sig = req.headers['stripe-signature'];
let event;
try {
event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
} catch (err) {
// On error, log and return the error message
console.log(`❌ Error message: ${err.message}`);
return res.status(400).send(`Webhook Error: ${err.message}`);
}
// Successfully constructed event
console.log('✅ Success:', event.id);
// Return a response to acknowledge receipt of the event
res.json({received: true});
});
推荐阅读
- c# - 字典作为类属性和方法的参数
- angular - Angular - ControlValueAccessor:未调用嵌套的 registerOnChange,但 FormControlValues 仍在更新
- json - 如何在 python 中使用 json 从 .json 文件中获取信息
- mysql - 为什么重复项没有被过滤掉
- flutter - 如何在类中初始化 void 函数
- apache-spark - 需要 Pyspark 字符串到日期转换模式
- freeradius - 如何使用隧道 EAP 身份验证设置 eap-ttls?
- oracle - Oracle - 仅当三列值唯一且第四列不等于给定字符时才允许插入项目
- sql - 将 sql 查询转换为 firestore 数据库的 nosql 查询
- javascript - Javascript:如何改进这些地图功能?