Serverless-offline: Getting raw body

[israelio]

In order to verify request signature, for example stripe webhook call one needs to get a hold of the raw body.

Currently offline server the body via event.body which is great but not suitable for signature verification purposes.

Any ideas how to solve it ?

[dherault]

How do you do it on AWS ?

[israelio]

This is an example with simple node, via app.use(require('body-parser').raw({type: '/'}));
https://stripe.com/docs/webhooks/signatures

With aws it can be done via patching the body mapping template
"rawBody": "$util.escapeJavaScript($input.body).replace("'", "'")",

[israelio]

This is the complete how to do it in aws:

In the AWS admin, go to your API gateway endpoint for your webhook, then go to the integration request.

Open the Body Mapping Templates section then select application/json -- Scroll down and you'll see your body mapping template
Add this line: "rawbody": "$util.escapeJavaScript($input.body)",

In your Lambda function, you should be able to use event.rawbody as is, without unescaping. (node.js)
var endpointSecret = "whsec_XXXXXXXX";
var headers = JSON.parse(event.headers);
var stripeEvent = stripe.webhooks.constructEvent(event.rawbody, headers["Stripe-Signature"], endpointSecret);

It would have been great if i could apply it to my aws env while being able to add via plugin / config this attribute to serverless offline

It would probably assist some other extensions which one can apply to aws directly and have them also working in the offline

[dherault]

Add this line: "rawbody": "$util.escapeJavaScript($input.body)",
to your serverless.yml somewhere at the request template session you should have it then :)

[ThePaulMcBride]

I'm running into the same issue at the minute. Where exactly should this be added in the serverless.yml?

[dnalborczyk]

gonna close this for inactivity. feel free to re-open if this is still an issue with this serverless-offline.

[zolbayars]

Hi @ThePaulMcBride, did you find a way?

[ThePaulMcBride]

Afraid not. I ended up having to get the event name from the body, then request that event from stripe again to check its authenticity.