"Get All Inputs" as raw text

Unknown

I'm integrating with Segment webhooks. I'd like to implement signature verification according to the Segment docs:


To do this, I'm using "Get All Inputs" with encoding set to "none". I'm expecting to get the raw request body, so that I can apply an hmac_sha1 function against it to check the signature that's provided in the x-signature request header. Unfortunately, it appears that I'm getting an object back, not the raw string, because when I try to apply hmac_sha1, I get this error:
 
hash_hmac(): Argument #2 ($data) must be of type string, array given

How can I get the entire raw body as an original text string, so that I can use hmac_sha1 with it?

Thanks!

Ray Deck

So one hacking-style idea is to rebuild the json from the object using the function in xano. Might produce the same string to match your source.

Unknown

Is there a filter for serializing an object into a JSON string? I haven't been able to find that. 

Ray Deck

 json_encode is what you are looking for. 

Unknown

Thanks. Unfortunately, the output from json_encode is different from the raw body. Of course, that makes sense, because it needs to match 100% exactly for the signature to match and the body isn't necessarily canonical json.

Ray Deck

 Have you tried changing the encoding on your get all input call? Default is JSON but I think there is a plain text option available to you

Unknown

 Yes, I tried that. It still comes back as an object, and when I use "Stop and Debug" it still looks like an JSON object, not a raw string

Ray Deck

 Yes, I ran a test myself. If it receives non-JSON it works as I would hope, but when it sees a string that could be JSON it gets too smart for its own good. I'm at an impasse:  and  do you have a better idea?

Sean Montgomery

Hmmm the get all inputs as text was designed for exactly this. Will see what's going on.

Brian Giometti

Did this ever get sorted out? I'm having the same issue hashing a payload for a different API. It seems the 'Get all inputs' function still parses the JSON (regardless of encoding setting) rather than leave it as a string.

Chris

I have the exact same issue. How do I get the "raw" body.

Brian Giometti

@Chris check out this snippet they created for doing this on Stripe webhooks (its applicable and standard for most signature verification).

https://community.xano.com/discussion/4178787/stripe-secure-webhook

I believe in the end it ended up needing some tweaks, but the 'Get All Inputs' function works now if you set enconding to 'none'