how to access a rawBody in an endpoint

[jesuscovam]

Describe the bug

To validate a request from stripe, I have to provide them the rawBody of the request, but every try throws an error.

I have tried other solutions that I read in other issues that worked for some users but I couldn't make it work

Solution with text: #3384 (comment)

Solution with buffer: #3384 (comment)

I think we have the same error #10339

Reproduction

pnpm dev this sveltekit app repo

have installed the stripe-cli and have an user to test it download stripe cli

do the login for the stripe with stripe login

connect the cli with the server stripe listen --forward-to http://localhost:5173/api/with-buffer

in a another terminal run a stripe event, the one I use is payment.intent stripe trigger payment_intent.succeeded

you can also test the other method with stripe listen --forward-to http://localhost:5173/api/with-text

Logs

StripeSignatureVerificationError: No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe?

System Info

System:
    OS: macOS 14.0
    CPU: (8) arm64 Apple M1
    Memory: 45.23 MB / 8.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.17.1 - ~/.nvm/versions/node/v18.17.1/bin/node
    Yarn: 1.22.10 - /opt/homebrew/bin/yarn
    npm: 9.6.7 - ~/.nvm/versions/node/v18.17.1/bin/npm
    pnpm: 8.8.0 - ~/Library/pnpm/pnpm
    Watchman: 2023.05.22.00 - /opt/homebrew/bin/watchman
  Browsers:
    Chrome: 117.0.5938.149
    Safari: 17.0
  npmPackages:
    @sveltejs/adapter-auto: ^2.0.0 => 2.1.0
    @sveltejs/adapter-vercel: ^3.0.3 => 3.0.3
    @sveltejs/kit: ^1.20.4 => 1.25.1
    svelte: ^4.0.5 => 4.2.1
    vite: ^4.4.2 => 4.4.10

Severity

blocking an upgrade

Additional Information

No response

[david-plugge]

Not sure but request.body should be the raw body that stripe expects. No need to call request.text() or similar.

[teemingc]

Based on https://github.com/stripe/stripe-node/blob/465c7f326daaa626028efff4c211739e1261921c/src/Webhooks.ts#L29 we want a string or Uint8Array. However this user mentions there are issues with request.text().

Can you try

// Uint8Array
const webhookPayload = new Uint8Array(await request.arrayBuffer());

https://stripe.com/docs/identity/handle-verification-outcomes#create-webhook

or

// base64 string
const webhookPayload = (new Buffer(await request.arrayBuffer())).toString('base64');

[jesuscovam]

I tried both methods and still got the same error, I added them as functions to the repo so everybody could test it.

[teemingc]

Yup, I tested the base64 string and it doesn't work either.

[jesuscovam]

I think the issue is that before the body of the request arrives to the endpoint, sveltekit it's interacting with it and then it arrives to the endpoint, is there a way we could access the body or request before sveltekit interacts with it?

They have an example on how to deal with this on nextjs because I guess they have the same issue https://github.com/stripe/stripe-node/blob/master/examples/webhook-signing/nextjs/pages/api/webhooks.ts

[teemingc]

See #10841 (comment) for a working example.