Webhooks and validate HMAC

Question

Hello,

I'm trying to execute an AWS Lambda function using the Bitbucket webhooks. I've generated a function url from the Lambda function and configured it as the URL for the webhook. Also setup a secret in the webhook.

I can successfully execute the Lambda function when I do any code pushes to the repository. I am trying to validate the HMAC using the x-hub-signature header. I'm using Python in my Lambda function. Every time when I compare the hash values they are different.

Below is what I'm trying in Python.

def checkSignature(signingSecret, signature, event):
signatureHash = signature.split('=')[1]
digest = hmac.new(signatureHash.encode('utf-8'), json.dumps(event).encode(), hashlib.sha256).hexdigest()

return hmac.compare_digest(digest, signatureHash)

Any help on what I am doing wrong would be really appreciated.

Thank you

frrusi · Answer

Hello, the following Python code successfully compares HMAC

import hashlib
import hmac

from aiohttp.web_request import Request

class CompareError(Exception):
def __init__(self) -> None:
super().__init__("HMAC did not match")

def _generate_hmac(body: bytes, key: str, algorithm: hashlib) -> str:
    key = key.encode("utf-8")
return hmac.new(key, body, algorithm).hexdigest()

async def calculate(request: Request, secret_key: str) -> None:
    body = await request.read()
    client_hmac = _generate_hmac(body, secret_key, hashlib.sha256)

if not hmac.compare_digest(f"sha256={client_hmac}", request.headers["X-Hub-Signature"]):
raise CompareError

My Stack:

* Atlassian Bitbucket v7.17.3
* aiohttp 3.8
* Python 3.10.10

unknown · Answer

Hi Brian,

Please find my answers below.

1. I tried adding the request body into the test request. Also tried pushing changes to the repository few times so it triggers the Lambda function when the code has changed.

2. It's version 8.9.5

3. I couldn't remember what I was passing there. After multiple tries I started looking for other alternative methods and found below.

https://aws.amazon.com/blogs/devops/integrating-codepipeline-with-on-premises-bitbucket-server/

I've proceed with this method and it's working fine for me so far.

Thank you

Brian Dannenmueller_z8dsuv · Answer

Thanks for posting this Chamara. I am having the exact same issue. Wanted to follow up and see if you are still working on this problem. My code is practically identical.

A few questions:
    1) How are you testing this? Do you copy-paste the body of the request from the admin console and put it in the body field of the Lambda test request?

2) Do you happen to know the version of Bitbucket Server that you are using?

3) Is the event being given to your checkSignature function actually the event body? Or are you trying to recreate the HMAC signature from the entire event, including its headers?