nestjs - 在 Guard 中访问请求的原始正文？

Question

有没有办法访问请求的原始正文？不是已经解析成json了吗？

@Injectable()
export class WooGuard implements CanActivate {
  secret: string;

  constructor(
    private readonly reflector: Reflector,
    private configService: ConfigService,
    ) {
      this.secret = this.configService.get<string>("woocommerce.webhook.secret");
    }

  async canActivate(
    context: ExecutionContext,
    ): Promise<boolean> {

    const request = context.switchToHttp().getRequest<Request>();
    request.body // this is parsed json

    // I am calculating the sha256 hash of the body with a secret for a webhook.
    // due to how the raw json is vs. the JSON.stringify(request.body), the signature is never the same.
  }
}

Answer 1

Shopify 有一个类似的方法来验证请求，这段代码对我有用，也许你可以改变它。

首先你需要安装加密:

npm install --save crypto

然后:

import { Injectable, CanActivate, ExecutionContext, HttpStatus } from '@nestjs/common';
const crypto = require('crypto');

@Injectable()
export class ShopifyAuthGuard implements CanActivate {
  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();
    const secretKey = <MY_KEY>;

    const hmac = request.headers["x-shopify-hmac-sha256"];

    const hash = crypto
      .createHmac('sha256', secretKey)
      .update(request.body)
      .digest('base64');

    if (hmac === hash) {
      return true;
    } else {
      throw new ForbiddenException("Not allowed");
    }
  }
}

最后在您的 Controller 上:

@Post()
@UseGuards(ShopifyAuthGuard)
async createNewOrder(@Body() orderDto: OrderDto) {}

希望能帮助到你!