how to access a rawBody in an endpoint

[eltigerchino]

Discussed in #10832

^{Originally posted by jesuscovam October 5, 2023}

Describe the bug

To validate a request from stripe, I have to provide them the rawBody of the request, but every try throws an error.

I have tried other solutions that I read in other issues that worked for some users but I couldn't make it work

Solution with text: #3384 (comment)

Solution with buffer: #3384 (comment)

I think we have the same error #10339

Reproduction

pnpm dev this sveltekit app repo

have installed the stripe-cli and have an user to test it download stripe cli

do the login for the stripe with stripe login

connect the cli with the server stripe listen --forward-to http://localhost:5173/api/with-buffer

in a another terminal run a stripe event, the one I use is payment.intent stripe trigger payment_intent.succeeded

you can also test the other method with stripe listen --forward-to http://localhost:5173/api/with-text

Logs

StripeSignatureVerificationError: No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe?

System Info

System:
    OS: macOS 14.0
    CPU: (8) arm64 Apple M1
    Memory: 45.23 MB / 8.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.17.1 - ~/.nvm/versions/node/v18.17.1/bin/node
    Yarn: 1.22.10 - /opt/homebrew/bin/yarn
    npm: 9.6.7 - ~/.nvm/versions/node/v18.17.1/bin/npm
    pnpm: 8.8.0 - ~/Library/pnpm/pnpm
    Watchman: 2023.05.22.00 - /opt/homebrew/bin/watchman
  Browsers:
    Chrome: 117.0.5938.149
    Safari: 17.0
  npmPackages:
    @sveltejs/adapter-auto: ^2.0.0 => 2.1.0
    @sveltejs/adapter-vercel: ^3.0.3 => 3.0.3
    @sveltejs/kit: ^1.20.4 => 1.25.1
    svelte: ^4.0.5 => 4.2.1
    vite: ^4.4.2 => 4.4.10

Severity

blocking an upgrade

Additional Information

No response

[eltigerchino]

@jesuscovam apologies for prematurely transferring the original issue to a discussion. After a bit more digging around, I found out SvelteKit is creating a new ReadableStream of the original request body. https://github.com/sveltejs/kit/blob/master/packages/kit/src/exports/node/index.js#L47-L93

I currently lack the knowledge to know if this is the cause of the issue. If it is, I wonder if using a Passthrough (next.js approach) could help with this? https://github.com/vercel/next.js/blob/canary/packages/next/src/server/body-streams.ts#L76-L89

EDIT: found an example SvelteKit repository implementing Stripe's webhook https://github.com/supabase-community/sveltekit-subscription-payments/blob/main/src/routes/api/webhooks/%2Bserver.ts

[jesuscovam]

@jesuscovam apologies for prematurely transferring the original issue to a discussion. After a bit more digging around, I found out SvelteKit is creating a new ReadableStream of the original request body. https://github.com/sveltejs/kit/blob/master/packages/kit/src/exports/node/index.js#L47-L93

I currently lack the knowledge to know if this is the cause of the issue. If it is, I wonder if using a Passthrough (next.js approach) could help with this? https://github.com/vercel/next.js/blob/canary/packages/next/src/server/body-streams.ts#L76-L89

EDIT: found an example SvelteKit repository implementing Stripe's webhook https://github.com/supabase-community/sveltekit-subscription-payments/blob/main/src/routes/api/webhooks/%2Bserver.ts

Don't you worry I saw you had a new release this week.

I tried the example from supabase but still got the error, I added the new method into the repo
new function with buffer

repo

[eltigerchino]

I finally got down to signing up to Stripe and trying to reproduce the issue with the Stripe CLI. It works perfectly with either await request.text() and Buffer.from(await request.arrayBuffer()). It does not seem to be an issue with SvelteKit modifying the request body.

import { json, text } from "@sveltejs/kit";
import { env } from "$env/dynamic/private";
import Stripe from "stripe";

const stripe = new Stripe(env.STRIPE_SECRET_KEY, {
  apiVersion: "2023-08-16",
});

export const POST = async ({ request }) => {
  const sig = request.headers.get("stripe-signature");
  const webhookSecret = env.STRIPE_WEBHOOK_SECRET;

  let event: Stripe.Event;

  try {
    if (!request.body || !sig || !webhookSecret) {
      return text("Client Error", { status: 400 });
    }
    // this works too!
    // const payload = await request.text();
    const payload = Buffer.from(await request.arrayBuffer());
    event = await stripe.webhooks.constructEventAsync(payload, sig, webhookSecret);
  } catch (err: any) {
    console.error(`❌ Error message: ${err.message}`);
    return text(`Webhook Error: ${err.message}`, { status: 400 });
  }

  return json({ event });
};

[flatoy]

For anyone else coming here looking for answers: If you input the wrong webhook signing secret, the error you get is about the request body. Really confusing 🫤

Make sure you use the local signing secret (printed in the terminal) if you're forwarding webhook events to your local app.