如何使用TransferWise的签名和公钥验证它们的有效负载？

Question

我正在尝试验证从TransferWise api进入我的web钩子的有效负载。

API：https://api-docs.transferwise.com/#webhook-events-webhook-handlers

我已经通过Google函数设置了一个公共https端点。

index.ts

import { wiseWebhookTest } from "./wise/webHooks";

exports.wiseWebhookTest = functions.https.onRequest(wiseWebhookTest);

webHooks.ts

const livePublicKey = `
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvO8vXV+JksBzZAY6GhSO
XdoTCfhXaaiZ+qAbtaDBiu2AGkGVpmEygFmWP4Li9m5+Ni85BhVvZOodM9epgW3F
bA5Q1SexvAF1PPjX4JpMstak/QhAgl1qMSqEevL8cmUeTgcMuVWCJmlge9h7B1CS
D4rtlimGZozG39rUBDg6Qt2K+P4wBfLblL0k4C4YUdLnpGYEDIth+i8XsRpFlogx
CAFyH9+knYsDbR43UJ9shtc42Ybd40Afihj8KnYKXzchyQ42aC8aZ/h5hyZ28yVy
Oj3Vos0VdBIs/gAyJ/4yyQFCXYte64I7ssrlbGRaco4nKF3HmaNhxwyKyJafz19e
HwIDAQAB
-----END PUBLIC KEY-----`;

const sandboxPublicKey = `
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwpb91cEYuyJNQepZAVfP
ZIlPZfNUefH+n6w9SW3fykqKu938cR7WadQv87oF2VuT+fDt7kqeRziTmPSUhqPU
ys/V2Q1rlfJuXbE+Gga37t7zwd0egQ+KyOEHQOpcTwKmtZ81ieGHynAQzsn1We3j
wt760MsCPJ7GMT141ByQM+yW1Bx+4SG3IGjXWyqOWrcXsxAvIXkpUD/jK/L958Cg
nZEgz0BSEh0QxYLITnW1lLokSx/dTianWPFEhMC9BgijempgNXHNfcVirg1lPSyg
z7KqoKUN0oHqWLr2U1A+7kqrl6O2nx3CKs1bj1hToT1+p4kcMoHXA7kA+VBLUpEs
VwIDAQAB
-----END PUBLIC KEY-----`;

const SIGNATURE_HEADER = "X-Signature-SHA256";

const validatePayload = (
  sandbox = false,
  payload: any,
  signature: string
) => {

  const sig = crypto.createVerify("RSA-SHA1");
  sig.update(payload);
  const verified = sig.verify(
    sandbox ? sandboxPublicKey : livePublicKey,
    signature,
    "base64"
  );

  return verified;
};

const isValidSignature = (request: functions.https.Request): boolean => {

  const signature = request.get(SIGNATURE_HEADER) as string;

  return validatePayload(true, request.rawBody, signature);
};

export const wiseWebhookTest = (
  request: functions.https.Request,
  response: functions.Response
): Promise<void> => {

  if (!isValidSignature(request)) {
    sendError(response, "Invalid Signature");
    return Promise.resolve();
  }

  console.log(`Signature is valid`);

  // respond positively to Wise, even though we don't process it
  response.status(200).send({});

  return Promise.resolve();
};

sig.verify()总是返回false。

我正在TransferWise沙箱中进行测试：https://sandbox.transferwise.tech/

上面的一些代码来自：https://github.com/fightmegg/transferwise

Answer 1

代码的一部分有const SIGNATURE_HEADER = "X-Signature-SHA256";，而第二部分有"RSA-SHA1"。我肯定不会推荐SHA-1用于签名，所以我会升级第二个代码片段以使用SHA-256。