GCP：Stripe webhook 错误：未找到与有效负载的预期签名匹配的签名

Question

Stripe version: "8.107.0"

I keep getting a Stripe webhook verification error whenever I run my webhook on GCP. I've tried using the raw body in the signature, as the code snippet below mentions, as well as other ways to pass the req.rawBody as other StackOverflow answers mention.

The weird thing is that this error seems to be thrown when I deploy to GCP, and not when I run locally. I tried to manually create the signature ( https://stripe.com/docs/webhooks/signatures#verify-manually ), and the same result there: locally the signatures match, on GCP it doesn't.

Our server is hosted on GCP GKE, and we serve requests to our server through an Nginx Reverse Proxy. Other stack overflow solutions mentioned Google Cloud Functions and Lambda. As far as I'm aware, we do not parse requests on GCP

I do use bodyParser.json(), but that's setup after this endpoint. These are the ways I've tried creating / using a rawBody:

app.use(express.json({verify: (req,res,buf) => { req.rawBody = buf }}));

bodyParser.json({
     verify: (req: any, res, buf) => {
      req.rawBody = buf.toString();
    },
  }),

event = stripe.webhooks.constructEvent(req.rawBody, sig, webhookSecret);

I based my code on the stripe example found here: https://github.com/stripe/stripe-node/blob/master/examples/webhook-signing/node-express/express.js

// Stripe requires the raw body to construct the event
app.post('/webhook', bodyParser.raw({type: 'application/json'}), (req, res) => {
  const sig = req.headers['stripe-signature'];

  let event;

  try {
    event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
  } catch (err) {
    // On error, log and return the error message
    console.log(`❌ Error message: ${err.message}`);
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }

  // Successfully constructed event
  console.log('✅ Success:', event.id);

  // Return a response to acknowledge receipt of the event
  res.json({received: true});
});

Any help would be appreciated, thanks.

Answer 1

问题出在我们的一个安装文件中，其中基本上一个空格或一个 \\n 字符被添加到我们的 webhookSecret

Answer 2

I just solved a similar issue, in short, here is how I solved it:

 // main.js
 server.use('*', cors());
-server.use(express.json()); // default on my boilerplate
+server.use(bodyParser.raw({ type: 'application/json' })); // use body-parser instead
 server.use(morgan('tiny'));

Then, just make sure you do not rewrite bodyParser.raw({type: 'application/json'}) before handling your webhooks, nor anywhere else in the app.