Skip to content

Fix webhook signature verification for multi-byte payloads and add byte[] overload#352

Open
IamPritamAcharya wants to merge 1 commit into
razorpay:masterfrom
IamPritamAcharya:fix/webhook-signature-utf8
Open

Fix webhook signature verification for multi-byte payloads and add byte[] overload#352
IamPritamAcharya wants to merge 1 commit into
razorpay:masterfrom
IamPritamAcharya:fix/webhook-signature-utf8

Conversation

@IamPritamAcharya
Copy link
Copy Markdown

Fixes #351

Problem

Webhook signature verification could fail for payloads containing special or multi-byte characters due to use of platform default charset.

Fix

  • Use UTF-8 encoding explicitly for hashing
  • Add overloaded method to accept raw byte[] payload for safer verification

Changes

  • Added verifyWebhookSignature(byte[] payload, ...)
  • Updated hashing logic to use StandardCharsets.UTF_8
  • Ensured backward compatibility by delegating the String-based method to the byte[] implementation

Tests

  • Added test case with UTF-8 payload (emoji and multi-byte characters)
  • Verified using:
    mvn -Dtest=UtilsTest test

Notes

  • This change is backward compatible
  • Full test suite failures are due to existing Mockito + OkHttp mocking issues unrelated to this change

@IamPritamAcharya
Copy link
Copy Markdown
Author

Hi @ankitdas13 @HarshLileshShah
Just following up on this PR. This fixes webhook verification issues with multi-byte payloads and adds a raw byte[] overload for correctness.
Would really appreciate a review when you get time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix webhook signature verification for payloads containing special characters

1 participant