jamius19 / paddle-verifier Goto Github PK

pSignature = URLDecoder.decode(pSignature, StandardCharsets.UTF_8); // SecurityUtils.Class
should by
pSignature = URLDecoder.decode(pSignature, StandardCharsets.UTF_8.name());

refer: https://stackoverflow.com/questions/6138127/how-to-do-url-decoding-in-java

Could you add support for Java under java 10 and release a new paddle-verifier? Which is really helpfull.

I have been using this module in my application for quite some time to verify paddle webhooks.
But today, I observed a problem that one webhook from paddle is constantly denied by this verifier. I couldn't find the problem. It is a completely valid webhook with proper p_signature value.
Can you help me finding the issue?

StringParser.generateInnerValues() will produce a wrong string length when the string contains a special character. (Eg.: á)
You should change val.length() to val.getBytes().length. (Probably you should use UTF-8 charset.)
Please refer to this StackOverflow issue

I implemented the verifier for myself in Kotlin based on this implementation. I found this issue and thought it'll help somebody.
You can receive a special character in the subscription_payment_succeeded webhook in the customer_name field. (You will receive the cardholder's name.)

I'm coming across this for the first time, so apologies if I've got hold of the wrong end of the stick but ...

Are you sure that the you need to URL decode the signature?

Looking at the other language examples from https://developer.paddle.com/webhook-reference/verifying-webhooks, it appears they only Base64 decode.

Also the signature that comes through from the Webhook tester https://sandbox-vendors.paddle.com/webhook-alert-test appears not to have url encoded the signature.