Unable to setup webhook in xero?

Question

I am trying to set up a webhook in Xero. I have created an endpoint which Xero hits and send some header and payload. I extract the hash from the header and match with the hash of payload but i never get the same hash. I am using the below code to do that.

router.post('/weebhook', function(req, res, next) {
  console.log(req.headers)
  console.dir(req.body);
  try {
    var xero_signature = req.headers['x-xero-signature']
    var encoded_data = encodePayload(req.body)
    console.log(xero_signature)
    console.log(encoded_data)
    if (encoded_data == xero_signature) {
      res.status(200).json();
    } else {
      res.status(401).json();
    }
  }catch(eror) {
    console.log(eror)
  }

});

function encodePayload(payload) {
console.log(JSON.stringify(payload))
const secret = 'TbJjeMSPAvJiMiD2WdHbjP20iodKCA3bL5is8vo47/pCcuGCsjtUDb7cBnWo20e0TBwZsQ/lPM41QgypzZE6lQ==';
const hash = crypto.createHmac('sha256',secret,true)
                   .update(JSON.stringify(payload))
                   .digest().toString('base64');
    return hash
}

Xero hash - NzQOq6yw6W6TKs1sQ1AJtMWX24uzzkyvh92fMxukreE=
my hash - L74zFdcuRsK3zHmzu9K37Y1mAVIAIsDgneAPHaJ+vI4=

Please let me know what is the issue ?

score 1 · Answer 1 · answered Dec 09 '19 at 06:23

1

There's a typescript sample application provided by Xero that implements the webhooks signature verification.

Does the code in here help you at all? https://github.com/XeroAPI/XeroWebhooksReceiver-Node/blob/master/src/server/server.ts#L58L59

Also, please delete and recreate your webhook as you've just provided everyone with your secret webhooks key.

answered Dec 09 '19 at 06:23

MJMortimer

865
5
10

I created a dummy app for testing webhook. I will definitely create new app – TechChain Dec 09 '19 at 06:25
I am using same for computing hash but still, hashes are different can u tell why – TechChain Dec 09 '19 at 07:16

score 0 · Answer 2 · answered Dec 09 '19 at 08:20

0

Change .update(JSON.stringify(payload)) to .update(payload.toString())

answered Dec 09 '19 at 08:20

rustyskates

856
4
10

why you recommend this ? – TechChain Dec 09 '19 at 17:59
https://devblog.xero.com/using-xero-webhooks-with-node-express-hapi-examples-7c607b423379 This example worked. It added body-parser as well – TechChain Dec 09 '19 at 18:18

Unable to setup webhook in xero?

2 Answers2