Trouble Validating Workflow Webhook Signature

Develop, Build & Integrate APIs & Integrations
1

I’ve created my own API using Node JS to connect various services together and since removing Basic Auth I’m having trouble validating hashes.

Whenever I get the Hubspot hash on the server side it seems to be different every time. Eg when I tested the webhook on https://webhook.site with two different requests and got:

x-hubspot-signature 84bbaa2032d9fba11aad241e14843b4fdc68f853ae8447a6f5114ddf3656b825

x-hubspot-signature 67f176ed749b3a5a2fe3f470246612264575077e5677f76b02c220e784532c66

Now my server side code to create the hash is:

const {SHA256} = require("crypto-js");

const clientSecret = "b17ff856-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
const body = req.body;
const hashString = clientSecret + body;

const signature = SHA256(hashString).toString();

10ceaecfcd9b286874d96bb8b26435f57982d96243197f770956341261990844

But it’s still not giving me the correct hash.

What am I doing wrong?

2

Even if I plug in the parameters needed into an online Hash generator, I still get an incorrect match. I’ve been going off this documentation:

I’ve also tried using different parameters but still no luck.

3

Hi @MichaelJC91,

I hope all is well with you :slightly_smiling_face:

When comparing the X-Hubspot-Signature I retrieved from using the requestinspector generated URL and testing it with a webhook subscription e.g. contact property change first name with the java code you provided, I’m able to see that the signature matches.

Could you try entering a URL to test the subscription in your ‘Webhook subscription details’ > Grab the X-Hubspot-Signature > Use the raw sample JSON payload to generate the X-Hubspot-Signature > Do a comparison and see if it matches?

If it doesn’t, we can pin down the issue to - client secret mismatch.

Can you try this out and let me know how it goes?

4

Hi @WendyGoh,

Thanks for replying so quickly!

I should clarify something before going forward, I’m using a Webhook that gets triggered via a Workflow. Is what your suggesting going to also work for that?

5

Hi @MichaelJC91,

Thank you for the clarification.

When verify request signatures in workflow webhooks, the concatention of the X-HubSpot-Signature header is different from the Webhooks API.

As documentated here: Verify request signatures in workflow webhooks

HubSpot will populate the webhook with a X-HubSpot-Signature header with a SHA-256 hash of the concatenation of the app-secret for your application, the HTTP method, the URI, and the unparsed body.

Hope this helps to clarify!

6

@WendyGoh after playing around with it a bit more I got it to work. Not sure what I did differently but it works now.

Thank you!