What is the Best Way to Validate the Origin of Requests from DBT Cloud Webhooks in Pipedream?

Help
1

This topic was automatically generated from Slack. You can find the original thread here.

The webhooks from DBT Cloud provide a way to validate the origin of the requests, but it requires the raw request body.

What would be the best way to do that in Pipedream?

2

How can I access the raw request body from an HTTP trigger?

3

I’ve tried re-encoding the body in JSON, but it doesn’t seem to create the exact same string as the original. :disappointed:

4

Here is some python code: signature = hmac.new(app_secret, request_body, hashlib.sha256).hexdigest()

What would be the node.js equivalent?

5

Are you using the job-run-completed source in Pipedream?
Or is it a custom HTTP webhook?

6

right now it’s custom.

7

Is the HTTP source emitting body only or the full request?

8

full request (because I need to check the headers for the auth)

9

Ah then the rawBody should be emitted also, are you able to see it?

10

Maybe I missed it :see_no_evil:

11

Haha happens with all of us

12

This is all I seem to get :thinking_face:

image.png

13

rawBody is undefined (unless I’m doing it wrong)

image.png

14

Strange, is dbt sending the rawBody? Pipedream doesn’t remove it, many sources use it for validating the webhooks

15

OH! :exploding_head: :man-facepalming:

image.png

16

I think I should be good now! :sweat_smile:

17

It’s working!

Thank you!! :pray:

18

Here’s the node.js code to authenticate the requests:

import crypto from "crypto";

const sign = crypto
  .createHmac('sha256', <DBT_WEBHOOK_KEY>)
  .update(<RAW_BODY_FROM_DBT_WEBHOOK>)
  .digest('hex');