Merge pull request #85 from Nexmo/code-update-2

niati · web-flow · commit de541e4be57f · 2020-05-27T11:25:33.000-04:00
update to signed callback code
diff --git a/messages/signed-webhooks/verify-signed-webhook.js b/messages/signed-webhooks/verify-signed-webhook.js
@@ -16,7 +16,7 @@ function handleInboundMessage(request, response){
     let token = request.headers.authorization.split(" ")[1]
     try{
         var decoded = jwt.verify(token, NEXMO_API_SIGNATURE_SECRET, {algorithms:['HS256']});
-        if(sha256(JSON.stringify(payload))!=decoded["payload_body"]){
+        if(sha256(JSON.stringify(payload))!=decoded["payload_hash"]){
             console.log("tampering detected");
             response.status(401).send();
         }

Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ function handleInboundMessage(request, response){`
`16`	`16`	`let token = request.headers.authorization.split(" ")[1]`
`17`	`17`	`try{`
`18`	`18`	`var decoded = jwt.verify(token, NEXMO_API_SIGNATURE_SECRET, {algorithms:['HS256']});`
`19`		`- if(sha256(JSON.stringify(payload))!=decoded["payload_body"]){`
	`19`	`+ if(sha256(JSON.stringify(payload))!=decoded["payload_hash"]){`
`20`	`20`	`console.log("tampering detected");`
`21`	`21`	`response.status(401).send();`
`22`	`22`	`}`