Event Webhook only works for a single event payload

[Abr3u]

Issue Summary

The helper library to validate the webhook signature only works when the payload has a single event. when the payload is an array of multiple JSON objects the signature always returns false. as seen here: https://github.com/sendgrid/sendgrid-nodejs/blob/main/packages/eventwebhook/src/eventwebhook.spec.js there is only 1 test and this tests uses a payload with a single event. I've opened a ticket with the sendgrid support team who told me to open an issue here stating the problem.

Steps to Reproduce

1. setup a signed webhook as seen here: https://sendgrid.com/docs/for-developers/tracking-events/getting-started-event-webhook-security-features/
2. if sendgrid sends a single event per request everything is fine and the verifySignature function always returns true
3. if sendgrid aggregates 2 or more events in a single request the verifySignature function returns false

Code Snippet

Basically the same as here: https://github.com/sendgrid/sendgrid-nodejs/blob/main/packages/eventwebhook/src/eventwebhook.spec.js with the payload being a 2 object array.

Exception/Log

No exception, just returns false

Technical details:

I have an example payload, signature and timestamp received that I shared with the support team when creating the ticket but since the payload contains sensitive information I'm not pasting that here. I'll be glad to do so via a private chat or something similar.
To quote the answer that I got from the technical support: "I have looked into this further and would agree this could be a library specific issue with the configuration since a single event works. I also reviewed the payload and do not see anything that is wrong. "

I'm running this code in a aws lambda running Node.js 12.x. To be able to use the webhook helper lib I copied this file into my lambda env https://github.com/sendgrid/sendgrid-nodejs/blob/main/packages/eventwebhook/src/eventwebhook.js and used it as shown in its respective tests (as linked above)

[thinkingserious]

Thanks for taking the time to report this @Abr3u!

Could you please provide your support ticket number so I can dig in and try to reproduce?

With best regards,

Elmer

[Abr3u]

Hey, Of course: https://support.sendgrid.com/hc/en-us/requests/5540009 Thanks in advance Elmer Thomas <notifications@github.com> escreveu no dia quinta, 7/01/2021 à(s) 01:11:

…

Thanks for taking the time to report this @Abr3u <https://github.com/Abr3u>! Could you please provide your support ticket number so I can dig in and try to reproduce? With best regards, Elmer — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1238 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACDAL7ONA4WF7PA3ENSJIU3SYUC3HANCNFSM4VVGOIVA> .

[JenniferMah]

Hi @Abr3u
I was able to reproduce this bug. This issue has been added to our internal backlog to be prioritized. Pull requests and +1s on the issue summary will help it move up the backlog.

[edsrodrigues]

Hi @JenniferMah @thinkingserious ,

I'm having exactly the same problem. It's not returning any exception and return false.

Do you have any expected resolution time for this?

[shwetha-manvinkurke]

@edsrodrigues We do not yet have an expected resolution time for this. That said, +1s and PRs will definitely help it move up our backlog.

[khaosans]

Yes, I realized that before but didn't know it was a bug. Thanks

[BeigeBox]

We're also running into this problem. +1

[mattmorganpdx]

I've hit this problem too

[AndreRog]

+1 I'm having the same issue

[nFangueiro]

+1 Happen to me already

[RJRVAZ]

+1 already had the same issue

[tiagobgarcia]

+1 Same issue here

[MihailCuculici]

+1 Same issue here

[uberj]

+1

[mayureshs]

+1 same issue here. It is also happening on Csharp side as well.

[DanielGeoffreyHodgkins]

@mayureshs if you're still needing a fix and anyone else who finds this issue while searching (like I did):

The test code has the correct way to stringify your payload from the incoming webhook

const PAYLOAD_MULTIPLE_EVENTS = JSON.stringify(eventsPayloadMultiple).split('},{').join('},\r\n{') + '\r\n'; // Be sure to include the trailing carriage return and newline after each event

https://github.com/sendgrid/sendgrid-nodejs/blob/main/packages/eventwebhook/src/eventwebhook.spec.js#L48

You may have to tweak it for your C# issues but this format should be consistent across the board. Hope that helps!