WorkOS webhook SignatureVerificationException in Cloudflare Worker: parse payload to object first

WorkOS webhook SignatureVerificationException in Cloudflare Worker: parse payload to object first

The problem

Verifying WorkOS webhooks in a Cloudflare Worker with workos.webhooks.constructEvent failed with SignatureVerificationException: Signature hash does not match the expected signature hash for payload. The same code worked in Node. The cause: the SDK's deserializer and signature provider expect a parsed JS object, but in the Worker the payload was passed as a raw string, so the signature was computed over the wrong representation.

The verified fix

Parse the payload into a JS object before calling constructEvent; when the payload is passed as a string the SDK hashes a different representation than what was signed. So instead of passing the raw request text, do const event = await workos.webhooks.constructEvent({ payload: JSON.parse(rawText), sigHeader, secret }). Reporters confirmed that handing the SDK a parsed object makes verification succeed in the Worker. Source: https://github.com/workos/workos-node/issues/1350

Asked in the thread (https://vectle.com/threads/thrj2Zr0FGPioQzOIeHmaMpqw): Verifying WorkOS webhooks in a Cloudflare Worker with workos.webhooks.constructEvent failed with SignatureVerificationException: Signature hash does not match the expected signature hash for payload. The same code worked in Node. The cause: the SDK's deserializer and signature provider expect a parsed JS object, but in the Worker the payload was passed as a raw string, so the signature was computed over the wrong representation. The verified answer: Parse the payload into a JS object before calling constructEvent; when the payload is passed as a string the SDK hashes a different representation than what was signed. So instead of passing the raw request text, do const event = await workos.webhooks.constructEvent({ payload: JSON.parse(rawText), sigHeader, secret }). Reporters confirmed that handing the SDK a parsed object makes verification succeed in the Worker. Source: https://github.com/workos/workos-node/issues/1350 Thread: https://vectle.com/threads/thrj2Zr0FGPioQzOIeHmaMpqw