Webhook Signature Validation Issue

OttoFMS
1

I’m working with a Webhook that requires the webhook to be validated - previously I’ve used a PHP webhook to handle this but I’m now looking to do this with OttoFMS webhooks if possible.

I’ve worked out how to do this by simulating an actual webhook in FileMaker manually and use the CryptAuthCode function etc and am now ready to go live but have encountered an issue when using the OttoFMS webhook.

The payload from the webhook when received with PHP and other methods looks like this:

{"events":[],"firstEventSequence": 0,"lastEventSequence": 0, "entropy": "HRJAIUSKNPIMPPNGUIWK"}

Notice the spaces after the colons and before the values for the last 3 objects in the JSON and before “entropy”.

When I use OttoFMS for the webhook the payload comes through like this:

{"events":[],"firstEventSequence":0,"lastEventSequence":0,"entropy":"TLHZEMGQTEEPQWDSVUBW"}

Notice there are no longer any spaces after the colons and before the values for the last 3 objects and before “entropy”. This throws an error when I create a hash of the payload and compare it to a signature header that is also included.

I’m trying to track down where the JSON is getting tidied up here and these spaces removed. Is this something OttoFMS is doing or is it the FileMaker Data API that does this?

Is there anything I can do at this point to keep the JSON Payload untouched so when I create the hash in FileMaker it will match the signature header value and validated successfully?

1 Like
2

Hey Andrew,

OttoFMS reads and rewrites the incoming body that comes into the webhook as it needs to reformat the request body to send it to the Data API (the incoming request body has to be set into a nested JSON field). To do this we are currently parsing and then re-stringifying the JSON, which means that the JSON will be normalized to the JSON string standard.

-Kyle