Unverified50% confidenceFactExact time
In Express, if the webhook route is registered after the express.json() middleware, the request body is parsed into an object, so what is passed to constructEvent is not the raw string, causing signature verification to fail.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedMost web frameworks (such as Express's express.json() and Next.js's req.json()) automatically parse the request body into a JavaScript object, and when it is later restored with JSON.stringify(body), details such as key order, whitespace and Unicode escaping may differ from the original bytes, causing the signature comparison to fail.75% similarUnverified案例中公司内容接口为GET请求，返回JSON格式，无需参数，状态码code 200表示操作成功62% similarUnverifiedStripe's official Node.js quickstart webhook code example begins with `let event = request.body;`, and only performs signature verification when the `if (endpointSecret)` condition holds, with a comment stating that the event is verified only when an endpoint secret is defined.62% similarUnverifiedEventSource only supports GET requests and cannot carry a JSON request body; therefore chat-type endpoints that require POST should switch to using fetch to read the stream.62% similarUnverified多数AI爬虫和Agent不会主动发送Accept: text/markdown请求头，而是沿用通用请求头或抓取原始HTML62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008229API
curl https://kongchang.com/api/v1/knowledge/claims/1008229MCP
get_claim(id=1008229)