What a provider's webhook signature actually covers. "raw-bytes" signs bytes
as delivered, so any re-encoding of the signed byte range (a JSON middleware,
a proxy that reformats) invalidates the signature — the range can be the
whole body or a string extracted from an envelope, as PayZen's kr-answer is.
"field-values" signs a selected set of values extracted from the payload, so a
re-encoded body still verifies and — the part that matters for security —
every field OUTSIDE the signed set arrives unauthenticated: such an adapter
must authenticate the delivery channel by another means and must never
present an unsigned field as trusted.
What a provider's webhook signature actually covers. "raw-bytes" signs bytes as delivered, so any re-encoding of the signed byte range (a JSON middleware, a proxy that reformats) invalidates the signature — the range can be the whole body or a string extracted from an envelope, as PayZen's kr-answer is. "field-values" signs a selected set of values extracted from the payload, so a re-encoded body still verifies and — the part that matters for security — every field OUTSIDE the signed set arrives unauthenticated: such an adapter must authenticate the delivery channel by another means and must never present an unsigned field as trusted.