如何在Node.js/express中實現Shopify webhook簽名？

Question

Shopify提供examples in Ruby and PHP來完成此操作。在我的節點/快遞程序，我嘗試：

var data = querystring.stringify(req.body); 
var calculatedSha256 = crypto.createHmac("SHA256", APP_SECRET).update(new Buffer(data, 'utf8')).digest('base64'); 

也

var data = req.body; 
var calculatedSha256 = crypto.createHmac("SHA256", APP_SECRET).update(new Buffer(data, 'utf8')).digest('base64'); 

但他們沒有提供相同的字符串到一個Shopify發送作爲簽名。

Answer 1

顯然，關鍵是要使用原始POST體，如下所述：middleware for saving raw post data in the request object won't "next" and cause timeout

Answer 2

有點老了，但想我會後我的解決方案：

var express  = require('express') 
    , bodyParser = require('body-parser') 
    , crypto  = require('crypto'); 

var app = express(); 

app.use(bodyParser.json({ verify: function(req, res, buf, encoding) { 
    req.headers['x-generated-signature'] = crypto.createHmac('sha256', 'SHARED_SECRET') 
    .update(buf) 
    .digest('base64'); 
} })); 

app.post('/webhook', function(req, res) { 
    if (req.headers['x-generated-signature'] != req.headers['x-shopify-hmac-sha256']) { 
    return res.status(401).send('Invalid Signature'); 
    } 
});