Can't Validate Webhooks POST Request

Developer Support APIs & Integrations
1

Hi all,

I’m having an issue trying to validate a webhooks request to my application. I’m following the instructions here: Accounts Dashboard | HubSpot but I can’t seem to generate a matching hash.

My code to validate the signature is as follows:

expected_signature = request.META.get('HTTP_X_HUBSPOT_SIGNATURE')
 raw_data = request.body
 sha256 = hashlib.sha256
 source_bytes = HUBSPOT_CLIENT_SECRET.encode("UTF-8") + raw_data
 local_signature = sha256(source_bytes).hexdigest()
 if expected_signature != local_signature:
 return HttpResponseForbidden()

This is written in Python using Django.

2

Hey @griffinskudder ,

I’m seeing some strange behavior here as well. I’ll touch base with my team and update this thread when I have more information.

3

Hey @griffinskudder ,

Quick update/request: Can you try casting the request body as a string?

4

Hi Derek,

No luck there. The request body is already in the format needed for the sha256 hashing algorithm to run on it, so trying to cast it to a string just causes that to fail.

Casting it to a string and then encoding it back into ASCII gives the same result as just leaving it as is.

5

Hey @griffinskudder ,

So the odd thing is that I’m having trouble validating the signature for test webhook notificaitons, but I’m succeeding for live webhook notifications by copy/pasting my client secret & request body using the following code:

import hashlib

client_secret = # Client secret here, pasted as a string
body = # Request body here, pasted as a string
source_string = client_secret + body
finalHash = hashlib.sha256(source_string).hexdigest()
print(finalHash)

Are the issues you’re seeing with live webhook notifications? The reason I’m thinking that it may be an encoding/stringification issue of some kind is because I haven’t been able to reproduce the issues myself.

I’m not particularly familiar with Django; is it possible that request.body isn’t encoded correctly? The following stackoverflow article seems to imply it’s a byte string:

6

Hi Derek,

Thanks very much for your help. It turned out to be the test webhook notifications.

I’ve just tested a live notification and all appears to be working.

7

Hey @griffinskudder ,

Makes sense, thanks for sharing! As an update, I just heard from the team this morning that the issue with test webhooks has been resolved, so going forward all webhook-related signatures should function correctly.