Subtle changes in how payloads are sent broke signature verification for consumers verifying incorrectly

What to do

• Check whether you use Svix in us. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2023-04-10 16:28 UTC and 2023-04-09 11:00 UTC may need a replay.

• Subscribe to Svix's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=svix works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Svix 1

1. resolvedApr 9, 2023, 11:00 AM UTC

   We changed the code to send the payload exactly the same way as it's sent to us (before, we were compacting it before sending). This meant that people that relied on the payload to be compact in order to verify webhooks (i.e they were verifying incorrectly) had verification failing. We reverted this immediately once it was reported signatures were failing for customers. While not a bug in Svix, as people verifying webhooks correctly wouldn't have had issues, it still caused disruption to our customers and we've added tests to ensure that we now always compact the payloads going forward. We are also working on making it even harder to get wrong for customers, but please refer to https://docs.svix.com/receiving/verifying-payloads/how for the correct way of verifying webhooks.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.