What is hash field in the BigCommerce webhook?

Question

How it generate? How I can validate it?

https://developer.bigcommerce.com/api/webhooks-getting-started

{ 
  \"store_id\": 11111,  
  \"producer\": \"         


        

Answer 1

I'd recommend using a custom header to validate the payload was from BigCommerce as noted in the getting started guide:

A headers object containing one or more name-value pairs, both string values (optional). If you choose to include a headers object, Bigcommerce will include the name-value pair(s) in the HTTP header of its POST requests to your callback URI at runtime. While this feature could be used for any purpose, one is to use it to set a secret authorization key and check it at runtime. This provides an additional level of assurance that the POST request came from Bigcommerce instead of some other party, such as a malicious actor.

Answer 2

This was answered by @KarenWhite, their developer evangelist in this thread. https://support.bigcommerce.com/s/question/0D51B00004G6kJf/incoming-webhook-posts-hash-field-in-payload

It is hashed with SHA-1, but it is not signed with the client secret:

$payload['hash'] = sha1(json_encode($payload));

Additionally, the stance on webhook security is documented in the 2018 townhall https://support.bigcommerce.com/s/article/BigCommerce-Town-Hall-February-2018

Q. How can I make sure that a webhook callback is initiated by BigCommerce only, and that the data is not altered between BigCommerce and my server endpoint? Can the hash returned in the webhook payload be used to verify the request?

A. Our webhooks today contain very little information -- they only contain an I.D. to go look up additional information. You would need to be authorized to verify that I.D. against the store’s API to determine the actual information being requested. We also secure our webhooks with TLS encryption, and enable developers to add their own headers to events for additional security.