首页 > 解决方案 > 无法验证 webhook Rails(签名无效)

问题描述

我正在尝试将 paddle.com 订阅集成到我的 Rails 应用程序
中 这是代码

require 'base64'
require 'php_serialize'
require 'openssl'
class SubscriptionsController < ApplicationController
  skip_before_action :verify_authenticity_token

  def check
    public_key = "-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7/mDtqUWyh2bb2QSkUE
PAPP7pwc6RhQrf9ikKVmssNTn0bDUcOi5dDhWON2u1xpAl6OMAX9lCPY7saHqzJR
MQrj0D3EmKDcXTBFnQWEOx4pToxhGsjpahGnq0kOtlig+1zFyYz78Wn3a58dxTIi
m1K6MOHj7R8TP2k6haLE8ZECAwEAAQ==
-----END PUBLIC KEY-----"

    if request.headers['Content-Type'] == 'application/json'
      data = JSON.parse(request.body.read)
    else
      data = params.as_json
    end

    signature = Base64.decode64(data['p_signature'])
    data.delete('p_signature')
    data.each {|key, value|data[key] = String(value)}
    data_sorted = data.sort_by{|key, value| key}

    data_serialized = PHP.serialize(data_sorted, true)

    digest    = OpenSSL::Digest::SHA1.new
    pub_key   = OpenSSL::PKey::RSA.new(public_key).public_key
    verified  = pub_key.verify(digest, signature, data_serialized)

    if verified
      puts 'Yay ok'
      head :ok
    else
      puts 'The signature is invalid!'
    end

  end
  end


我使用 Paddle webhook 模拟器对其进行了测试,但我得到的错误是无效签名。“签名无效”,表示无法验证

Processing by SubscriptionsController#check as */*
  Parameters: {"user_id"=>"1", "p_signature"=>"WXY2kaJc12zmM9ZkpKt5IHpmknG6cEOBmtWlEGtY/PPrOvDXcfQnRbW0iNSRGEpSp9oWzkHOGxnFRW3P+fiEmSJnsDU+8SdbMB8b7S4Wc5U8Ld7pv9t5oCpHiJI3HWeUrwWMpJz/vOMRiqHQxM6iBT/LCzgrbVNYuzYQRIModbODJ2L8spu5oqlP10CTHyFsEVw8t3PAvVsaNPobZvU9cLNhDpNi1fyuqUQ6nPP0xX6xo/iewoL16gSMWhQw11saC/XssxSktDdszAa+f5cl/6sN5IqfVOfTGNiYc6M0DEG6OQ+tGX9xt4MmUju3H7W4BzQ6g68t5dFXjmfigaq+vf5K7PTxrX99AJPx1XR6lIwdp/9A2lBYPpcAVdIeESaugzlKrkMm3vmi2idnSW9XawJPDykIUPwVyrVmkcabNWeMVBtBNM4BhTqCPe4McNKm02en5gUMdokFCsljRwm9Ut5cP7hrIP8RtXQDj650WB1Uf6Q3EW0UYzJM9yv8nMiJHDWYF0RSlI8qJkIBOzf6j2Ykl4QVT6hAmfXVHID70I9Okq9v0GAZEY8wX3gOPUqBr6JNxVVCO1eaqDchSR6IN0s2q8dm5UWSk5ugDIRY7/6wLj5+01efHTW9xq24FMHvDwfVzGk5Q2JA7/LMyn59SHcAasz8UJGaITl/iSqaZkA="}
The signature is invalid!
No template found for SubscriptionsController#check, rendering head :no_content
Completed 204 No Content in 26ms (ActiveRecord: 0.0ms)

我怎样才能验证它?
桨文档在这里

标签: ruby-on-rails

解决方案


我刚刚遇到了类似的问题。我试图dataparams. 但是,问题在于params包括额外的东西,例如actioncontroller。验证的重点是确保您收到的正是 Paddle 发送的;任何额外的东西都会导致验证失败。

解决方案是直接从请求中获取数据:

data = request.request_parameters

推荐阅读