How SurveyMonkey API creates the hmac?

Question

We are trying to verify that the SurveyMonkey hmac we receive (sm-signature) is correct. To check this we create an hmac and compare it to SurveyMonkey's hmac.

We create the hmac as follows (we are working with nodejs):

    let bodyString = JSON.stringify(req.body);
    
    let body = Buffer.from(bodyString, "ascii");
    let apiClientId = Buffer.from(surveyMonkeyClientId, "ascii");
    let apiSecret = Buffer.from(surveyMonkeyApiSecret, "ascii");
    let hmac = crypto
        .createHmac('sha1', apiClientId+'&'+apiSecret)
        .update(Buffer.from(body))
        .digest()
        .toString('base64');

We have verified this code with (it is with python): https://github.com/SurveyMonkey/public_api_docs/blob/main/includes/_webhooks.md

But for some reason this doesn't work as expected. Because the hmac we generated is not the same as the hmac generated by SurveyMonkey (sm-signature).

Could someone help us? Thanks!

Answer 1

The problem is the signature, that comes with spaces between the json fields and when you do JSON.stringify this removes the spaces.

One possible solution is:

let payloadString = JSON.stringify(req.body);
payloadString = payloadString.replace(/":/g, '": ');
payloadString = payloadString.replace(/,/g, ', ');