Invalid signature from webhook - Githubissues

laravel / cashier-paddle

Cashier Paddle provides an expressive, fluent interface to Paddle's subscription billing services.

https://laravel.com/docs/cashier-paddle

MIT License

245 stars 57 forks source link

Invalid signature from webhook #10

Closed robsontenorio closed 4 years ago

robsontenorio commented 4 years ago

Cashier Paddle Version: 1.0@beta
Laravel Version: 7.15
PHP Version: 7.4
Database Driver & Version: Mysql 8.0

Description:

I am getting invalid signature error from webhook. After debug just noticed :

Cashier relies on $request->except() , so $request->all()
The problem is $request automatically includes a extra field q, and this field should not be included on signature validation process.

https://github.com/laravel/cashier-paddle/blob/409f9305093ca57c78588c82671691c7c1141a47/src/Http/Middleware/VerifyWebhookSignature.php#L45

By removing q from field list it works.

  $fields = $request->except([self::SIGNATURE_KEY, 'q']);

Steps To Reproduce:

Just create any Laravel form
Submmit
On controller store() method place dd($request->all()))
See extra field at bottom q

robsontenorio commented 4 years ago

It was a problem with nginx config

before

try_files $uri $uri/ /index.php?q=$uri&$args;

after

try_files $uri $uri/ /index.php?$query_string;