Repository navigation
docs: fix Banking webhook HMAC example in README - #1744
Conversation
validateBankingHMAC(hmacKey, hmacSign, ...) treats the first argument as the signature and the second as the key, so the README example passing (KEY, SIGNATURE) always returned false. Point the example at the non-deprecated validateHMACSignature(hmacKey, hmacSignature, data) instead.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the README.md documentation to use the correct method name validateHMACSignature instead of validateBankingHMAC in the TypeScript example. The reviewer suggested instantiating the HmacValidator class in the example to make it fully functional and clear.
| Verify the authenticity (where you retrieve the hmac key from the CA and the signature from the webhook header); | ||
| ``` typescript | ||
| const isValid = hmacValidator.validateBankingHMAC("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString) | ||
| const isValid = hmacValidator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString) |
There was a problem hiding this comment.
The example uses 'hmacValidator' without instantiating it first. Since 'HmacValidator' is a class with instance methods, it should be instantiated before calling 'validateHMACSignature' to make the example fully functional and clear.
| const isValid = hmacValidator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString) | |
| const hmacValidator = new HmacValidator(); | |
| const isValid = hmacValidator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString); |
There was a problem hiding this comment.
Good catch on the missing instantiation, but the suggested fix would not work as written: the package does not export HmacValidator (capitalized). src/index.ts exports the class as hmacValidator (lowercase), so new HmacValidator() would throw a ReferenceError.
I updated the example to import and instantiate the exported class:
import { hmacValidator } from "@adyen/api-library";
const validator = new hmacValidator();
const isValid = validator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString);This matches the usage in the existing tests (new HmacValidator() in src/__tests__/hmacValidator.spec.ts).
validateBankingHMAC(hmacKey, hmacSign, ...) treats the first argument as the signature and the second as the key, so the README example passing (KEY, SIGNATURE) always returned false. Point the example at the non-deprecated validateHMACSignature(hmacKey, hmacSignature, data) and instantiate the validator, since the package exports the class.
jeandersonbc
left a comment
jeandersonbc
left a comment
There was a problem hiding this comment.
Thank you for the PR @mrSamDev! Indeed, we need to go over some examples and docs that are outdated. Contributions like this one is highly valuable!
Thanks! Glad I could help. If I run into any other issues while using the library, I’ll be happy to contribute again. |
Summary
I hit this while building against the Adyen Node.js API library. The "Parsing and Authenticating Banking Webhooks" example in the README never worked.
isValidcame backfalseevery time.Root cause
The example calls the deprecated
validateBankingHMACmethod:The implementation reads those arguments the other way around. It signs with the first one and compares against the second:
Pass
(KEY, SIGNATURE)in the order the names suggest and you getfalseforever. The example is a trap, and a silent one at that.Fix
Point the example at the non-deprecated
validateHMACSignature(hmacKey, hmacSignature, data), which takes its arguments in the order the names suggest:I checked the implementation in
src/utils/hmacValidator.tsand the tests insrc/__tests__/hmacValidator.spec.tsbefore writing this. The change is one line, and it makes the example do what it claims.