我正在寻找学习如何使用Ruby验证Paddle Webhook？ Their example has an option on how to do it with PHP, Python and JavaScript, but no Ruby.关于如何做的任何想法？
以下旧示例不起作用：
require 'base64'
require 'php_serialize'
require 'openssl'
public_key = '-----BEGIN PUBLIC KEY-----
MIICIjANBgkqh...'
# 'data' represents all of the POST fields sent with the request.
# Get the p_signature parameter & base64 decode it.
signature = Base64.decode64(data['p_signature'])
# Remove the p_signature parameter
data.delete('p_signature')
# Ensure all the data fields are strings
data.each {|key, value|data[key] = String(value)}
# Sort the data
data_sorted = data.sort_by{|key, value| key}
# and serialize the fields
# serialization library is available here: https://github.com/jqr/php-serialize
data_serialized = PHP.serialize(data_sorted, true)
# verify the data
digest = OpenSSL::Digest::SHA1.new
pub_key = OpenSSL::PKey::RSA.new(public_key).public_key
verified = pub_key.verify(digest, signature, data_serialized)
if verified
puts "Yay! Signature is valid!"
else
puts "The signature is invalid!"
end
这是JS中的their example：
// Node.js & Express implementation
const express = require('express');
const querystring = require('querystring');
const crypto = require('crypto');
const Serialize = require('php-serialize');
const router = express.Router();
const pubKey = `-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----`
function ksort(obj){
let keys = Object.keys(obj).sort();
let sortedObj = {};
for (var i in keys) {
sortedObj[keys[i]] = obj[keys[i]];
}
return sortedObj;
}
function validateWebhook(jsonObj) {
const mySig = Buffer.from(jsonObj.p_signature, 'base64');
delete jsonObj.p_signature;
// Need to serialize array and assign to data object
jsonObj = ksort(jsonObj);
for (var property in jsonObj) {
if (jsonObj.hasOwnProperty(property) && (typeof jsonObj[property]) !== "string") {
if (Array.isArray(jsonObj[property])) { // is it an array
jsonObj[property] = jsonObj[property].toString();
} else { //if its not an array and not a string, then it is a JSON obj
jsonObj[property] = JSON.stringify(jsonObj[property]);
}
}
}
const serialized = Serialize.serialize(jsonObj);
// End serialize data object
const verifier = crypto.createVerify('sha1');
verifier.update(serialized);
verifier.end();
let verification = verifier.verify(pubKey, mySig);
if (verification) {
return 'Yay! Signature is valid!';
} else {
return 'The signature is invalid!';
}
}
/* Validate a Paddle webhook to this endpoint, or wherever in your app you are listening for Paddle webhooks */
router.post('/', function(req, res, next) {
res.send(validateWebhook(req.body));
});
module.exports = router;
我如何使用Ruby验证Webhook？有没有其他方法可以验证Webhook？
以下是示例Webhook请求：
(
[alert_name] => subscription_created
[cancel_url] => https://checkout.paddle.com/subscription/cancel?user=4&subscription=8&hash=b0bd354fexamplec39b0ff93c917804acf
[checkout_id] => 1-61ff5b400-756ea301a9
[currency] => USD
[email] => wleffler@example.net
[event_time] => 2019-08-10 18:33:58
[marketing_consent] =>
[next_bill_date] => 2019-08-18
[passthrough] => 1132
[quantity] => 67
[status] => active
[subscription_id] => 4
[subscription_plan_id] => 5
[unit_price] => unit_price
[update_url] => https://checkout.paddle.com/subscription/update?user=5&subscription=4&hash=e937ed03f1637e45d912f4f4d293a
[user_id] => 6
[p_signature] => HM2Isn1k6Sy1cKySQGoFH...
)
编辑：
我正在使用Ruby 2.5.5和Ruby on Rails5。目前最后仍然总是“ false”。我将在控制台上进行浏览：
这是我在Rails中获得的（伪）数据：
data = {
"alert_id"=>"1",
"alert_name"=>"alert_created",
"cancel_url"=>"https://...",
"checkout_id"=>"1",
"user_id"=>"1",
"p_signature"=>"fwWXqR9C..."
}
public_key = '-----BEGIN PUBLIC KEY-----sDFKJSD2332FKJLWJF......'
然后我执行以下操作：
signature = Base64.decode64(data['p_signature'])
data.delete('p_signature')
data.each {|key, value|data[key] = String(value)}
data_sorted = data.sort_by{|key, value| key}
data_serialized = data_sorted.to_json
digest = OpenSSL::Digest::SHA1.new
pub_key = OpenSSL::PKey::RSA.new(public_key)
verified = pub_key.verify(digest, signature, data_serialized)
最后 verified 始终为 false 。我究竟做错了什么？
答案 0 :(得分：3)
您提到的Ruby示例不起作用，因为您需要获取数据变量。这必须从控制器发送到处理请求的某个类。
尝试一下：
在routes.rb中
document.addEventListener('keydown', e => {
if (e.code == 'KeyU' && e.altKey) {
// Do stuff here
}
})
在控制器中
get 'check', to: 'test#check'在验证程序类中
class TestController < ApplicationController
def check
verification = SignatureVerifier.new(check_params.as_json)
if verification
#... do something
end
end
private
def check_params
params.permit.all
end
end
答案 1 :(得分：0)
如果这对未来的任何人有帮助。以下代码为我解决了问题。
[1] 将此添加到处理您的 API 集成/网络钩子的控制器类：
# main Paddle end-point for paddle generated webhook events
def paddle
if PaddleWebhooks.verify_paddle_authenticity(params.as_json)
msg= 'Yay! Signature is valid!:' + params.to_s
else
msg= 'The signature is invalid!:' + params.to_s
end
render json: msg.to_json, status: :ok
end
Paddle 期望 webhooks 处理程序返回状态代码 200 (:ok)。我们还添加了 msg 以返回到 Paddle 的 webhook 模拟器，以便您可以检查从他们那里收到的内容（及其结构）。进入生产环境后，您当然可以将其删除。
[2] 将 php_serialize gem 添加到您的 gemfile
# Use for verifying Paddle's webhooks
gem "php-serialize"
[3] 创建支持类：
class PaddleWebhooks
require 'base64'
require 'php_serialize'
require 'openssl'
def self.verify_paddle_authenticity(data)
// PADDLE_PUBLIC_KEY should have your paddle provided key as a single line
// and without the "-----BEGIN PUBLIC KEY-----" and
// "-----END PUBLIC KEY-----" strings
public_key =ENV['PADDLE_PUBLIC_KEY']
signature = Base64.decode64(data['p_signature'])
# Remove the p_signature parameter as per Paddle's instructions
data.delete('p_signature')
# Remove also from the data the controller and action (key,value) pairs
data.delete('controller')
data.delete('action')
# Ensure all the data fields are strings
data.each {|key, value|data[key] = String(value)}
# Sort the data
data_sorted = data.sort_by{|key, value| key}
# Serialized with JSON library
data_serialized = PHP.serialize(data_sorted, true)
# verify the data
digest = OpenSSL::Digest::SHA1.new
pub_key = OpenSSL::PKey::RSA.new(Base64.decode64(public_key))
verified = pub_key.verify(digest, signature, data_serialized)
verified
end
end