Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Small issue regarding signature validation.

See original GitHub issue

Issue Nature: Doubt

Issue Code Reference: https://github.com/razorpay/razorpay-node/blob/e3cb39105b540dea83372ff147df6fe5bf53d689/lib/utils/razorpay-utils.js#L94

As the above snippet suggests, the request body is being converted to a string form. But the Object.toString function always returns [object Object] as a string rather than the stringified object. Wouldn’t using JSON.stringify here be better?

Could this be the reason why some signatures received from the Razorpay Webhooks do not match the ones calculated on my Node.js server?

Issue Analytics

State:
Created 3 years ago
Reactions:1
Comments:5 (1 by maintainers)

Top GitHub Comments

2reactions

deve-shcommented, Jan 13, 2021

No resolution yet. I simply setup idempotency for now and validate whether the data that’s sent in the request is actually valid data that exists on Razorpay’s servers using their APIs.

2reactions

abhijit-hotacommented, Jan 13, 2021

According to the webhook docs, we shouldn’t parse or cast the req.body in any way.

If you’re using Express along with the body-parser package then your request bodies are automatically parsed to an object.

I’m assuming this is the source of the error. We should instead, pass in the “raw body” to the function.

See this comment

Top Results From Across the Web

Validating digital signatures, Adobe Acrobat

Follow these steps to set up digital signature validation, certify a PDF, timestamp a document, ad validate or remove a digital signature in ......

Verify the digital signature on a signed email message

Similarly, when you receive a message in Microsoft Outlook that contains a digital signature, it's important to verify that the signer is who...

Signature Verification Cure Process - CISA

This document is one in a series created as part of the Cybersecurity and Infrastructure Security. Agency (CISA) Elections Infrastructure Government ...

Signature Validation Token RFC 9321 - IETF Datatracker

Introduction Electronic signatures have a limited lifespan regarding when they can be validated and determined to be authentic.

SIGNATURE VERIFICATION GUIDE - Arizona Secretary of State

This Guide will help those reviewing ballot affidavit signatures determine whether the ballot affidavit signature and the voter's signature in the voter.