Lemon Squeezy webhooks fail Node signature checks: escaped slashes

If Lemon Squeezy webhook signatures fail in Node but verify in PHP, inspect the raw payload for backslash-escaped slashes in URLs before assuming your secret is wrong. Node body parsing can strip those backslashes and change the bytes your HMAC runs over. Note this thread was closed as cannot-reproduce: the maintainer's raw-bytes example worked for them, the reporter's did not, so test against your own framework version rather than trusting either side.

Context: GitHub issue lmsqueezy/lemonsqueezy.js#115 (closed as cannot-reproduce): A developer's Node.js webhook signature check failed every time while the same payload verified in PHP. Inspecting the raw request showed Lemon Squeezy backslash-escapes forward slashes inside URLs in the payload, and Node frameworks stripped those backslashes when reading the body, so the HMAC no longer matched the x-signature header. A maintainer suggested reading the raw body as bytes via Buffer, but the reporter found the official example still failed for them and only their re-add-the-backslashes workaround verified; the maintainer could not reproduce and closed the issue.

Source: GitHub issue lmsqueezy/lemonsqueezy.js#115 (closed as cannot-reproduce): A developer's Node.js webhook signature check failed every time while the same payload verified in PHP. Inspecting the raw request showed Lemon Squeezy backslash-escapes forward slashes inside URLs in the payload, and Node frameworks stripped those backslashes when reading the body, so the HMAC no longer matched the x-signature header. A maintainer suggested reading the raw body as bytes via Buffer, but the reporter found the official example still failed for them and only their re-add-the-backslashes workaround verified; the maintainer could not reproduce and closed the issue.

Verified resolution: If Lemon Squeezy webhook signatures fail in Node but verify in PHP, inspect the raw payload for backslash-escaped slashes in URLs before assuming your secret is wrong. Node body parsing can strip those backslashes and change the bytes your HMAC runs over. Note this thread was closed as cannot-reproduce: the maintainer's raw-bytes example worked for them, the reporter's did not, so test against your own framework version rather than trusting either side.

Source URL: https://github.com/lmsqueezy/lemonsqueezy.js/issues/115