{"record":{"id":"a0571b274d7b87b7","repo":"remotion-dev/remotion","slug":"no-body-was-provided-to-validatewebhooksignature","errorCode":null,"errorMessage":"No 'body' was provided to validateWebhookSignature().","messagePattern":"No 'body' was provided to validateWebhookSignature\\(\\)\\.","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"packages/lambda-client/src/validate-webhook-signature.ts","lineNumber":21,"sourceCode":" * @see [Documentation](https://remotion.dev/docs/lambda/validatewebhooksignature)\n */\nexport const validateWebhookSignature = ({\n\tsecret,\n\tbody,\n\tsignatureHeader,\n}: {\n\tsecret: string;\n\tbody: unknown;\n\tsignatureHeader: string;\n}) => {\n\tif (!secret) {\n\t\tthrow new TypeError(\n\t\t\t\"No 'secret' was provided to validateWebhookSignature().\",\n\t\t);\n\t}\n\n\tif (!body) {\n\t\tthrow new TypeError(\n\t\t\t\"No 'body' was provided to validateWebhookSignature().\",\n\t\t);\n\t}\n\n\tif (typeof require === 'undefined') {\n\t\tthrow new Error('validateWebhookSignature can only be called from Node.JS');\n\t}\n\n\tconst Crypto = require('crypto');\n\n\tconst hmac = Crypto.createHmac('sha512', secret);\n\tconst signature = `sha512=${hmac.update(JSON.stringify(body)).digest('hex')}`;\n\n\tif (!signatureHeader || signatureHeader === 'NO_SECRET_PROVIDED') {\n\t\tthrow new Error('No webhook signature was provided');\n\t}\n\n\tif (signatureHeader !== signature) {","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-client/src/validate-webhook-signature.ts#L3-L39","documentation":"Thrown by validateWebhookSignature() when the `body` argument is falsy. The HMAC is computed over the JSON-serialized request body, so an empty/missing body cannot be authenticated — the signature would always be wrong.","triggerScenarios":"Calling validateWebhookSignature with body: null, body: undefined, body: '' or body: 0. The guard is `if (!body)`.","commonSituations":"Reading req.body before the body parser has populated it; an incoming GET probe with no body; a framework that sets body to null for empty payloads; misordered middleware.","solutions":["Register body-parser / express.json() before the webhook route so req.body is populated.","Reject requests with no body at the route level (404/400) before invoking the validator.","Confirm the request is a POST with Content-Type: application/json."],"exampleFix":"// before\napp.post('/webhook', (req, res) => {\n  validateWebhookSignature({secret, body: req.body, signatureHeader: req.headers['X-Remotion-Signature']});\n});\n\n// after\napp.post('/webhook', express.json(), (req, res) => {\n  if (!req.body) return res.status(400).send('empty body');\n  validateWebhookSignature({secret, body: req.body, signatureHeader: req.headers['X-Remotion-Signature']});\n});","handlingStrategy":"validation","validationCode":"if (!req.body) return res.status(400).send('empty body');\nvalidateWebhookSignature({secret, body: req.body, signatureHeader});","typeGuard":"const hasBody = (b: unknown): boolean => b !== undefined && b !== null && b !== '';","tryCatchPattern":"try {\n  validateWebhookSignature({secret, body: req.body, signatureHeader});\n} catch (err) {\n  return res.status(401).send('unauthorized');\n}","preventionTips":["Register express.json() (or equivalent) before the webhook route.","Reject GET requests to the webhook endpoint.","Validate Content-Type: application/json at the route boundary."],"tags":["lambda","webhook","security","validation"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}