Validating webhook request from Fireblocks

For those using Fireblocks and are currently working on validating the webhook request I hope you’ll find this useful

The webhook includes a signature fireblocks-signature that’s used for validating the request came from Fireblocks

In their documentation they offer code sample using javascript and python, if you’re using PHP you can do the following:

$verified = openssl_verify($body, $signature, $publicKey, OPENSSL_ALGO_SHA512);

in the code above the parameters are the following :
– $body – the raw body of the request (stringified json)
– $signature – base64_decoded signature string we got from header (fireblocks-signature)
– $publicKey – public key provided by Fireblocks if your testing in (sandbox environment)

$verified – will be set to 1 if it passes and 0 if not

In my experience my verification keep failing because I was calling json_encode() to the $body, which is an array initially, and this alters the json data when it contains large float values. And this will automatically mismatch the original body you receive in the request. My take on this is check the incomming request body first, most likely it’ll be in raw json string format already and you might not need to do a json_encode(), and just use it in your verification.

There were a couple of explanations I found online on this like this one : https://stackoverflow.com/questions/41824959/json-encode-adding-lots-of-decimal-digits

More information can found in Fireblock’s webhook documentation : https://developers.fireblocks.com/docs/webhooks-notifications