如何验证 shopify webhook 的 HMAC - nodejs Lambda

Question

我无法使用“crypto-js”包验证来自 shopify 的 webhook 响应。

我正在使用：“Node.js、AWS-Lambda、crypto-js”和以下代码进行验证

var CryptoJS = require("crypto-js");
var getRawBody = require("raw-body");
var Buffer = require('buffer/').Buffer  // note: the trailing slash is important!
    
exports.handler = async (event, context) => {
        let hmac = event.hmac;
       
        const bodyString = Buffer.from(event.body, "utf8").toString();
        var bodyForVerification = bodyString.replace('/\\/g', '\\\\');
    
        let firma = CryptoJS.HmacSHA256(bodyForVerification, "****");
        var hashInBase64 = CryptoJS.enc.Base64.stringify(firma);
        let calculatedHmacBase = hashInBase64.toString(CryptoJS.enc.hex);
        if(hmac == calculatedHmacBase {
        console.log("verificado");    
    }
    };

HMAC 不同..

Answer 1

我将此中间件用于我在 Shopify 上的公共和私人应用程序， 使用加密，它已被弃用，但适用于我的代码。

const crypto = require('crypto');
const verify = function (req, res, next) {
  if (req.query.shop) {
    if (!req.query.signature) {
      return false;
    }
    console.log(req.query);
    const signature = req.query.signature;
    const sharedSecret = process.env.SHOPIFY_SHARED_SECRET;
    const def = req.query;
    delete def.signature;
    const sortedQuery = Object.keys(def).map(key => `${key}=${Array(def[key]).join(',')}`).sort().join('');;
    const calculatedSignature = crypto.createHmac('sha256', sharedSecret).update(sortedQuery).digest('hex');
    if (calculatedSignature === signature) {
      console.log('validated');
      return next();
    }
    console.log('not validated');
    return false;
  }
};
module.exports = verify;