Verifying X-Fitbit-Signature header in node.js

[clarisa]

Hi,

please, someone can help me with this.
I'm trying to verify the X-Fitbit-Signature (node.js)

      var hmac = crypto.createHmac('sha1', FITBIT_CLIENT_SECRET + '&');
      var requestHash = hmac.update(req.body.toString()).digest('base64');

      if (requestHash !== req.get('x-fitbit-signature')) {

.........

something is worng, I never get a succes calculated hmac digest.

I can recieve the notificatios.

[clarisa · Accepted solution]

solved 

var data = JSON.stringify(req.body);

var requestHash = hmac.update(data).digest('base64');

[JeremiahFitbit]

@clarisa: One important detail: You should verify the signature *before* you JSON.parse the request body. JavaScript does not guarantee Object property ordering, which means that the body string sent by the server may not be the same string returned by JSON.stringify.

[clarisa]

Many thanks for the recommendation!!!