app/controllers/forest/shopify/webhooks_controller.rb
# Compare the computed HMAC digest based on the shared secret and the request contents
# to the reported HMAC in the headers
#
# https://shopify.dev/tutorials/manage-webhooks#verify-webhook
Compare the computed HMAC digest based on the shared secret and the request contents
to the reported HMAC in the headers


Compare the computed HMAC digest based on the shared secret and the request contents to the reported HMAC in the headers
def verify_webhook
        data = request.body.read
        hmac_header = request.env['HTTP_X_SHOPIFY_HMAC_SHA256'].to_s
        calculated_hmac = Base64.strict_encode64(OpenSSL::HMAC.digest('sha256', SHARED_SECRET, data))
        verified = ActiveSupport::SecurityUtils.secure_compare(calculated_hmac, hmac_header)
        unless verified
          head :bad_request
        end
      end
def verify_webhook data = request . body . read hmac_header = request . env [ 'HTTP_X_SHOPIFY_HMAC_SHA256' ] . to_s calculated_hmac = Base64 . strict_encode64 ( OpenSSL :: HMAC . digest ( 'sha256' , SHARED_SECRET , data ) ) verified = ActiveSupport :: SecurityUtils . secure_compare ( calculated_hmac , hmac_header ) unless verified head :bad_request end end
Compare the computed HMAC digest based on the shared secret and the request contents
to the reported HMAC in the headers
Compare the computed HMAC digest based on the shared secret and the request contents to the reported HMAC in the headers
# Unverified requests return early