Service hooks: HMAC authentication not working with nextjs renderer

This article provides information for addressing problem with using HMAC authentication in service hooks. The HMAC authentication will not work when the service hook payload is sent to javascript application.

Jun 27, 2025
Knowledge

Title

URL Name

service-hooks-hmac-authentication-not-working-with-javascript-apps

Article Number

000285004

Environment

Product: Sitefinity Version: 13.3, 14.4, 15.x OS: All supported OS versions Database: All supported Microsoft SQL Server versions

Question/Problem Description

Setting up service hooks to work with HMAC authentication as per Sitefinity documentation, create service hooks #authentication https://www.progress.com/documentation/sitefinity-cms/create-service-hooks#authentication-nbsp- is not working.

The HMAC signature sent by the service hook and produced in Sitefinity never matches the HMAC calculated in the receiving application.

Steps to Reproduce

1. Create a service hook in SF for any Trigger (e.g. publish news item) and enable HMAC authentication 2. Enter a secret for the HMAC authentication 3. Send the payload of the service hook towards nextjs app. 4. In Sitefinity service hook send the service hook payload to the nextjs app 5. Publish news item and trigger the service hook. Result: the recieving application will not be able to calculate the same HMAC signature like the one sent by the service hook in sf-signature header.

Clarifying Information

For HMAC authentication the service hook in Sitefinity will send two http headers:

sf-signature and sf-signature-timestamp. Header sf-signature will carry the base64 encoded result from using sha256 over the body of the service hook payload. The sf-signature-timestamp carries the Unix time when the HMAC was produced. This time is used on the application accepting the service hook payload to try compute the same HMAC signature.

Error Message

Defect Number

Enhancement Number

Cause

Sitefinity is sending the request body as indented JSON (with formatting whitespaces). NextJs is parsing the JSON and then reserializing it which removed the whitespaces.

This was is before the signature was calculated and thus it was different.

in nextjs, it's necessary to calculate the signature on the raw text body, without any prior parsing. Otherwise some values might get their string representation changed (ex. "-77.0" becomes "-77").
Example using the Next.js App API Router:

    // use .text() to get the raw body and calculate HMAC
    const rawBody = await request.text();
    // using .json() and JSON.stringify can cause signatures to differ
    const parsedJsonBody = await request.json();
    const bodyString = JSON.stringify(parsedJsonBody);

The HMAC or in fact any other values sent from Sitefinity CMS to nextjs application will be researialized which will produce differences in what was sent and what was recieved.

Resolution

Disable automatic request body parsing in Next.js you can add the following option in next.config.js: set bodyParser: false

module.exports = {
    api: {
        // Disable body parsing to handle raw body for HMAC verification
        // Needed for Pages API Routes
        bodyParser: false,
    },
};

This config option is referenced here in the Next.js documentation, api routes #custom config https://nextjs.org/docs/pages/building-your-application/routing/api-routes#custom-config

After this whatever Sitefinity sends from its webservices will be received as is in nextjs.

For a sample on nextjs service receiving and validating HMAC from Sitefinity service hooks refer to attachment pagesRouterService.ts

Workaround

Notes

Keyword Phrase

Last Modified Date

12/3/2025 1:39 PM

Service hooks: HMAC authentication not working with nextjs renderer

Files(1)

Was this article helpful?

Was this article helpful?

Service hooks: HMAC authentication not working with nextjs renderer

Information

Related Articles