Merge pull request #2856 from internetee/fix-hmac-signature

Fixed ident request  webhook hmac validation

Author: vohmar

Gemfile.lock

@@ -197,7 +197,7 @@ GEM
       coffee-script-source
       execjs
     coffee-script-source (1.12.2)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.5)
     connection_pool (2.4.1)
     countries (4.0.1)
       i18n_data (~> 0.13.0)
@@ -610,7 +610,7 @@ DEPENDENCIES
   capybara (~> 3.40.0)
   coffee-rails (>= 5.0)
   company_register!
-  concurrent-ruby (= 1.3.4)
+  concurrent-ruby (= 1.3.5)
   countries
   data_migrate (~> 9.0)
   database_cleaner
@@ -657,8 +657,8 @@ DEPENDENCIES
   redis
   rest-client
   rexml
-  rubyzip
   ruby-openai
+  rubyzip
   sass-rails
   select2-rails (= 4.0.13)
   selectize-rails (= 0.12.6)

app/controllers/eeid/webhooks/identification_requests_controller.rb

@@ -42,8 +42,24 @@ def render_invalid_signature
 
       def valid_hmac_signature?(ident_type, hmac_signature)
         secret = ENV["#{ident_type}_ident_service_client_secret"]
-        computed_signature = OpenSSL::HMAC.hexdigest('SHA256', secret, request.raw_post)
-        ActiveSupport::SecurityUtils.secure_compare(computed_signature, hmac_signature)
+        Rails.logger.debug("[valid_hmac_signature?] ident_type: #{ident_type}")
+        Rails.logger.debug("[valid_hmac_signature?] ENV secret present: #{secret.present?}")
+        Rails.logger.debug("[valid_hmac_signature?] request.raw_post: #{request.raw_post.inspect}")
+        Rails.logger.debug("[valid_hmac_signature?] Provided HMAC signature: #{hmac_signature.inspect}")
+
+        # Remove all spaces and newlines from raw body for canonicalization
+        canonical_body = request.raw_post.to_s.gsub(/[\s]+/, '')
+        Rails.logger.debug("[valid_hmac_signature?] request.body (canonical no-space): #{canonical_body}")
+
+        provided = hmac_signature.to_s.strip
+
+        computed_signature = OpenSSL::HMAC.hexdigest('SHA256', secret, canonical_body)
+        Rails.logger.debug("[valid_hmac_signature?] Computed HMAC signature: #{computed_signature}")
+
+        result = ActiveSupport::SecurityUtils.secure_compare(computed_signature, provided)
+        Rails.logger.debug("[valid_hmac_signature?] Signature valid: #{result}")
+
+        result
       end
 
       def verify_contact(contact)

config/boot.rb

@@ -1,4 +1,5 @@
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
 
+require 'logger'
 require 'bundler/setup' # Set up gems listed in the Gemfile.
 require 'bootsnap/setup'