Synthetic teaching example for a website delivery brief. Not a client result, live account test or certification.
An innocent middleware change can alter the evidence
When a payment integration fails signature checks after a website rebuild, ask where the original request bytes are captured. A body parser can preserve every JSON value while changing spaces or ordering during reserialisation. The application then checks different evidence from the evidence the sender signed.
| Supplied body | Meaning | Demo digest matches original? |
|---|---|---|
| {"id":"evt_demo","ok":true} | Original fictional values | true |
| { "id": "evt_demo", "ok": true } | Same values, different spaces | false |
| {"id":"evt_demo","ok":false} | Changed value | false |
Use the filled example
Download the finite Node checker and filled input. Run with Node 24 or newer; no account, API or network is used.
node checks.mjs webhook-raw-body-evidence webhook-raw-body-evidence.jsonThe example uses a clearly named dummy key, SYNTHETIC_NOT_A_SECRET, and SHA-256 HMAC over the supplied strings. It outputs equalJsonSemantics true, originalMatches true, reserialisedMatches false and changedMatches false. No provider secret is needed or requested. The key is intentionally public and must never be used for a real endpoint.
What should the supplier demonstrate?
In an authorised test environment, trace the exact body from ingress to the provider’s supported verification routine. Show what each middleware receives and whether it consumes or changes the body. A real verification result also depends on the correct endpoint secret, signature-header parsing and the provider’s timestamp rules; do not debug by disabling validation.
Keep this problem separate from processing a verified event only once. A correct signature does not stop legitimate redelivery, and durable business processing cannot authenticate the sender. The durable inbox example demonstrates that separate local transaction question.
This is a generic byte-level teaching check, not a Stripe signature implementation. It has no timestamp tolerance, header handling, secret rotation or replay defence. It never receives public traffic or changes existing endpoints. Use the current official SDK and an independently reviewed deployment contract for a real integration.
Primary facts and limits
Stripe webhook signatures: Requires the raw request body for its signature verification; this generic HMAC fixture does not implement the Stripe protocol.
Sources reviewed 15 October 2026. The supplied input and acceptance rules are original teaching design; check current platform versions and your actual delivery contract before implementation.