Securing Twitter Webhook












1















As mentioned in Twitter Docs
Steps to validate a request




  1. Create a hash using your consumer secret and incoming payload body.

  2. Compare created hash with the base64 encoded x-twitter-webhooks-signature value.


Here is my code for doing so:



const buffer = Buffer.from(JSON.stringify(ctx.request.body))

const expectedHash = crypto.createHmac('sha256', TWITTER_CONSUMER_SECRET).update(buffer).digest('base64')


The x-twitter-webhooks-signature header from twitter and the hash generated does not match. Also, the post at https://twittercommunity.com/t/validating-the-webhook-signature-header-in-node-js/102525 says that it's JSON.stringify() issue. I'm using koa and koa-body, how can I fix the hash mismatch?






node.js twitter webhooks koa







share|improve this question





























    1















    As mentioned in Twitter Docs
    Steps to validate a request




    1. Create a hash using your consumer secret and incoming payload body.

    2. Compare created hash with the base64 encoded x-twitter-webhooks-signature value.


    Here is my code for doing so:



    const buffer = Buffer.from(JSON.stringify(ctx.request.body))
    
const expectedHash = crypto.createHmac('sha256', TWITTER_CONSUMER_SECRET).update(buffer).digest('base64')


    The x-twitter-webhooks-signature header from twitter and the hash generated does not match. Also, the post at https://twittercommunity.com/t/validating-the-webhook-signature-header-in-node-js/102525 says that it's JSON.stringify() issue. I'm using koa and koa-body, how can I fix the hash mismatch?






    node.js twitter webhooks koa







    share|improve this question



























      1












      1








      1








      As mentioned in Twitter Docs
      Steps to validate a request




      1. Create a hash using your consumer secret and incoming payload body.

      2. Compare created hash with the base64 encoded x-twitter-webhooks-signature value.


      Here is my code for doing so:



      const buffer = Buffer.from(JSON.stringify(ctx.request.body))
      
const expectedHash = crypto.createHmac('sha256', TWITTER_CONSUMER_SECRET).update(buffer).digest('base64')


      The x-twitter-webhooks-signature header from twitter and the hash generated does not match. Also, the post at https://twittercommunity.com/t/validating-the-webhook-signature-header-in-node-js/102525 says that it's JSON.stringify() issue. I'm using koa and koa-body, how can I fix the hash mismatch?






      node.js twitter webhooks koa







      share|improve this question
















      As mentioned in Twitter Docs
      Steps to validate a request




      1. Create a hash using your consumer secret and incoming payload body.

      2. Compare created hash with the base64 encoded x-twitter-webhooks-signature value.


      Here is my code for doing so:



      const buffer = Buffer.from(JSON.stringify(ctx.request.body))
      
const expectedHash = crypto.createHmac('sha256', TWITTER_CONSUMER_SECRET).update(buffer).digest('base64')


      The x-twitter-webhooks-signature header from twitter and the hash generated does not match. Also, the post at https://twittercommunity.com/t/validating-the-webhook-signature-header-in-node-js/102525 says that it's JSON.stringify() issue. I'm using koa and koa-body, how can I fix the hash mismatch?






      node.js twitter webhooks koa




      node.js twitter webhooks koa






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Nov 14 '18 at 16:39









      dmulter

      1,1693917




      1,1693917










      asked Nov 14 '18 at 7:46









      Niket MalikNiket Malik

      6801920




      6801920
























          1 Answer
          1






          active

          oldest

          votes


















          1














          Found a solution. Used koa-bodyparser instead of koa-body then sha256 of ctx.request.rawBody matches with the header.






          share|improve this answer























            Your Answer






            StackExchange.ifUsing("editor", function () {
            StackExchange.using("externalEditor", function () {
            StackExchange.using("snippets", function () {
            StackExchange.snippets.init();
            });
            });
            }, "code-snippets");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "1"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53295279%2fsecuring-twitter-webhook%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            1














            Found a solution. Used koa-bodyparser instead of koa-body then sha256 of ctx.request.rawBody matches with the header.






            share|improve this answer




























              1














              Found a solution. Used koa-bodyparser instead of koa-body then sha256 of ctx.request.rawBody matches with the header.






              share|improve this answer


























                1












                1








                1







                Found a solution. Used koa-bodyparser instead of koa-body then sha256 of ctx.request.rawBody matches with the header.






                share|improve this answer













                Found a solution. Used koa-bodyparser instead of koa-body then sha256 of ctx.request.rawBody matches with the header.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Nov 15 '18 at 13:31









                Niket MalikNiket Malik

                6801920




                6801920
































                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Stack Overflow!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53295279%2fsecuring-twitter-webhook%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    -

                    Popular posts from this blog

                    Florida Star v. B. J. F.

                    Image
                    Florida Star v. B. J. F. From Wikipedia, the free encyclopedia Jump to navigation Jump to search United States Supreme Court case Florida Star v. B. J. F. Supreme Court of the United States Argued March 21, 1989 Decided June 21, 1989 Full case name The Florida Star v. B. J. F. Citations 491 U.S. 524 ( more ) 109 S. Ct. 2603; 105 L. Ed. 2d 443; 1989 U.S. LEXIS 3120; 57 U.S.L.W. 4816; 16 Media L. Rep. 1801 Prior history The Florida Star v. B.J.F., 530 So.2d 286 (1988) Supreme Court of Florida; Florida Star v. B.J.F., 499 So.2d 883 (1986) Fla. Dist. Court of Appeals Holding Florida Stat. § 794.03 is unconstitutional to the extent it makes the truthful reporting of information that was a matter of public record unlawful, as it violates the First Amendment. Court membership Chief Justice William Rehnquist Associate Justices William J. Brennan Jr.  · Byron White Thurgood Marshall  · Harry Blac...
                    Read more

                    Danny Elfman

                    Image
                    Danny Elfman From Wikipedia, the free encyclopedia Jump to navigation Jump to search Danny Elfman Elfman at the 2010 San Diego Comic-Con Born Daniel Robert Elfman ( 1953-05-29 ) May 29, 1953 (age 65) Los Angeles, California, U.S. Spouse(s) Bridget Fonda ( m.  2003) Children 1 Musical career Genres Rock [1] ska [2] new wave film music video game music Occupation(s) Composer, singer, songwriter, record producer Instruments Trombone guitar percussion vocals keyboards [3] Years active 1972–present Associated acts Oingo Boingo James Newton Howard Daniel Robert Elfman (born May 29, 1953) is an American composer, singer, songwriter, and record producer. Elfman first became known for being the lead singer and songwriter for the band Oingo Boingo from 1974 to 1995. He is well known for scoring films and television shows, particularly his frequent collabora...
                    Read more

                    Lugert, Oklahoma

                    Image
                    Unincorporated community in Oklahoma, United States Lugert, Oklahoma Unincorporated community Foundations from the town of Lugert at the bottom of Lake Altus-Lugert Lugert, Oklahoma Location within the state of Oklahoma Coordinates: 34°53′45″N 99°16′31″W  /  34.89583°N 99.27528°W  / 34.89583; -99.27528 Coordinates: 34°53′45″N 99°16′31″W  /  34.89583°N 99.27528°W  / 34.89583; -99.27528 Country United States State Oklahoma County Kiowa Time zone UTC-6 (Central (CST))  • Summer (DST) UTC-5 (CDT) GNIS feature ID 1100597 Lugert is an unincorporated community in Kiowa County, Oklahoma. [1] The town of Lugert was founded in 1901 on 80 acres (320,000 m 2 ). In the town, there was a general store that housed the Post office and sold dry goods, school supplies, groceries, harnesses, axes and much more. It was named for Frank Lugert, who had moved to the area in 1898. Lugert owned land where the town was sited and also owned the general st...
                    Read more