Wrong HMAC sent to webhook

[Eugen_Litvinov]

I was trying to add a webhook with HMAC verification using node.js.

Signature received in x-hub-signature header always differs from calculated in webhook.

I've also verified signature in online HMAC generators like 

https://www.freeformatter.com/hmac-generator.html or 

https://www.devglan.com/online-tools/hmac-sha256-online

All of them returns same digest as I have in webhook, however different than bitbucket sends in headers.

Webhook calculates digest from raw body payload (string, utf8) using secret generated for webhook.

What can be wrong there?

[Theodora Boudale]

Hi and welcome to the community!

I am unable to reproduce the issue you are reporting. I just tested this in a test repo of mine and the signature that Bitbucket sends in headers is the same as in the online HMAC generators you posted here.

If you have admin access to the repo, you can navigate to Webhooks from Repository settings, select View requests for the webhook, and then select Enable history. When an event occurs that triggers the webhook, you can view its details there. When looking at the details, there is an option to copy the body as raw string. You can use that to calculate the HMAC for this request.

If you're still experiencing issues, you can create a ticket with the support team for further investigation, as we'll need additional details to look into this. You can create a ticket via https://support.atlassian.com/contact/#/, in "What can we help you with?" select "Technical issues and bugs" and then Bitbucket Cloud as product. When you are asked to provide the workspace URL, please make sure you enter the URL of the workspace that is on a paid billing plan to proceed with ticket creation. The support ticket will be visible only to you, Atlassian staff, and any users you add as participants, so anything you post there won't be publicly visible.

Kind regards,
Theodora