How to validate HMAC signature coming from external webhook?

[joandvgv]

Hi!

I have a REST endpoint that receives data from an external webhook.
This includes an HMAC signature. But I'm having issues validating it because hasura change the order of the keys (it orders them alphabetically) you can see #5854 for reference.

While I get the JSON Spec doesn't guarantee the order of the keys, this behavior prevents me from validating the signature with the actual data the external provider signed it with.

What should I do in this case to bypass, what I would call, a hasura limitation?