When I receive a webhook event I try to verify the signature as mentioned in the docs, sometimes the verification is successful and sometimes not.
What I'm doing wrong?
static createSha256Hash(data: string, key: string): string {
if (isEmpty(data)){
throw new ValidationException();
}
const sha256Hasher = crypto.createHmac('sha256', key);
return sha256Hasher.update(data).digest('hex');
}
public validateWebhookSignature(requestContext: RequestContextModel): void {
const signature = requestContext?.headers?.['X-Hub-Signature-256'].replace('sha256=', '');
const body = JSON.stringify(requestContext?.body);
const hash = CryptoUtil.createSha256Hash(body, this._appSecret);
if (!signature || !hash) {
throw new ValidationException();
} else if (signature !== hash) {
throw new UnauthorizedException();
}
}