Merge pull request #523 from stripe/ob-webhook-convert-buffer

Handle Buffer instances in Webhook.constructEvent

lib/Webhooks.js

@@ -1,16 +1,18 @@
+'use strict';
+
+var Buffer = require('safe-buffer').Buffer;
 var crypto = require('crypto');
 
 var utils = require('./utils');
 var Error = require('./Error');
 
 var Webhook = {
-  DEFAULT_TOLERANCE: 300,
+  DEFAULT_TOLERANCE: 300, // 5 minutes
 
   constructEvent: function(payload, header, secret, tolerance) {
-    var jsonPayload = JSON.parse(payload);
-
     this.signature.verifyHeader(payload, header, secret, tolerance || Webhook.DEFAULT_TOLERANCE);
 
+    var jsonPayload = JSON.parse(payload);
     return jsonPayload;
   },
 };
@@ -25,6 +27,9 @@ var signature = {
   },
 
   verifyHeader: function(payload, header, secret, tolerance) {
+    payload = Buffer.isBuffer(payload) ? payload.toString('utf8') : payload;
+    header = Buffer.isBuffer(header) ? header.toString('utf8') : header;
+
     var details = parseHeader(header, this.EXPECTED_SCHEME);
 
     if (!details || details.timestamp === -1) {

test/Webhook.spec.js

@@ -2,6 +2,7 @@
 
 var stripe = require('../testUtils').getSpyableStripe();
 var expect = require('chai').expect;
+var Buffer = require('safe-buffer').Buffer;
 
 var EVENT_PAYLOAD = {
   id: 'evt_test_webhook',
@@ -125,6 +126,14 @@ describe('Webhooks', function() {
 
       expect(stripe.webhooks.signature.verifyHeader(EVENT_PAYLOAD_STRING, header, SECRET)).to.equal(true);
     });
+
+    it('should accept Buffer instances for the payload and header', function() {
+      var header = generateHeaderString({
+        timestamp: (Date.now() / 1000),
+      });
+
+      expect(stripe.webhooks.signature.verifyHeader(new Buffer(EVENT_PAYLOAD_STRING), new Buffer(header), SECRET, 10)).to.equal(true);
+    });
   });
 });