无现金签名未在 JavaScript 中验证

问题描述 投票:0回答:2

我正在使用nodejs(koa服务器)在我们的网站中集成无现金网关。为了验证签名,他们在标头中发送请求正文和时间戳,以便验证它,我必须通过将时间戳与原始正文连接来生成签名(金额字段必须包含小数点后 2 位数字)。

我在javascript中面临问题,因为cashfree希望金额字段位于小数点后两位,即使是整数,但javascript转换(1898.00到1898)基本上当我解析float中的数字并使用toFixed(2)时,它不理解十进制数字) 因此数据类型更改为字符串。 我想在 javascript 中以浮点数形式传递 payment_amount 和 order_amount 以获得整数 是否可以这样做,请在这里帮助我

理想对象 {"data":{"order":{"order_id":"order_453912VQqDHqtQDCQdRfZj5Q1W4G3apB","order_amount":17500.00,"order_currency":"INR","order_tags":{"address":"Hello World"," localTransactionId":"2290"," paymentFor":"1849939000004509001","type":"发票"}}," payment":{"cf_ payment_id":2148739167," payment_status":"SUCCESS"," payment_amount":17500.00 ," payment_currency":"INR"," payment_message":"交易成功"," payment_time":"2023-09-15T17:19:10+05:30","bank_reference":"85511","auth_id" :null," payment_method":{"app":{"channel":null,"upi_id":null}}," payment_group":"wallet"},"customer_details":{"customer_name":null,"customer_id" :"1849939000003987046","customer_email":"[email protected]","customer_phone":"+918909997453"}},"event_time":"2023-09-15T17:19:12+05:30","类型":"PAYMENT_SUCCESS_WEBHOOK"}

我的代码能够生成什么

1)整数没有小数位

{"data":{"order":{"order_id":"order_453912VQqDHqtQDCQdRfZj5Q1W4G3apB","order_amount":17500,"order_currency":"INR","order_tags":{"address":"Hello World", "localTransactionId":"2290"," paymentFor":"1849939000004509001","type":"发票"}}," payment":{"cf_ payment_id":2148739167," payment_status":"SUCCESS"," payment_amount": 17500," payment_currency":"INR"," payment_message":"交易成功"," payment_time":"2023-09-15T17:19:10+05:30","bank_reference":"85511","auth_id ":null," payment_method":{"app":{"channel":null,"upi_id":null}}," payment_group":"wallet"},"customer_details":{"customer_name":null,"customer_id ":"1849939000003987046","customer_email":"[email protected]","customer_phone":"+918909997453"}},"event_time":"2023-09-15T17:19:12+05:30","输入“:”PAYMENT_SUCCESS_WEBHOOK“}

  1. 字符串数据类型

{"data":{"order":{"order_id":"order_453912VQqDHqtQDCQdRfZj5Q1W4G3apB","order_amount":"17500.00","order_currency":"INR","order_tags":{"address":"Hello World ","localTransactionId":"2290"," paymentFor":"1849939000004509001","type":"发票"}}," payment":{"cf_ payment_id":2148739167," payment_status":"成功"," payment_amount ":"17500.00"," payment_currency":"INR"," payment_message":"交易成功"," payment_time":"2023-09-15T17:19:10+05:30","bank_reference":"85511 ","auth_id":null," payment_method":{"app":{"channel":null,"upi_id":null}}," payment_group":"wallet"},"customer_details":{"customer_name": null,"customer_id":"1849939000003987046","customer_email":"[email protected]","customer_phone":"+918909997453"}},"event_time":"2023-09-15T17:19:12+05: 30","类型":"PAYMENT_SUCCESS_WEBHOOK"}

javascript validation webhooks signature cashfree
2个回答
0
投票

你的答案是:

// Sample object
const inputData = {
    "data": {
        "order": {
            "order_id": "order_453912VQqDHqtQDCQdRfZj5Q1W4G3apB",
            "order_amount": 17500.00, // This should be converted to a float with 2 decimal places
            "order_currency": "INR",
            // ...
        },
        "payment": {
            "cf_payment_id": 2148739167,
            "payment_status": "SUCCESS",
            "payment_amount": 17500.00, // This should be converted to a float with 2 decimal places
            "payment_currency": "INR",
            // ...
        },
        // ...
    },
    // ...
};

// Convert order_amount and payment_amount to floats with 2 decimal places
inputData.data.order.order_amount = parseFloat(inputData.data.order.order_amount).toFixed(2);
inputData.data.payment.payment_amount = parseFloat(inputData.data.payment.payment_amount).toFixed(2);

console.log(inputData);

0
投票

我认为你根本不需要转换对象。即使在解析对象之前,您也应该先获取原始主体并进行签名验证。

请参阅此处:https://github.com/cashfree/cashfree-pg-webhook/blob/main/node/server.js

基本上,我们只需将原始请求正文复制到另一个参数中并使用它进行签名验证。

app.use(
  express.json({
    limit: '2mb',
    verify: (req, res, buf) => {
      req.rawBody = buf.toString();
    },
  })
);

编辑:koa 的最终解决方案是只包含未解析的主体。但总的来说,您需要获取原始请求并使用它而不是解析的主体。

app.use( koaBody({includeUnparsed: true }), ) 
const unparsedBody = ctx.request.body[Symbol.for('unparsedBody')]; 

使用

"koa-body": "^4.2.0"
更改 package.json,现在你的 ctx 将在上面提到的 keyas 中拥有未解析的主体

© www.soinside.com 2019 - 2024. All rights reserved.