# How to use CryptoJS package in Postman Flows Evaluate block

**URL:** <https://community.postman.com/t/how-to-use-cryptojs-package-in-postman-flows-evaluate-block/74443>\
**Category:** Help Hub\
**Tags:** postman-flows\
**Created:** [January 27, 2025, 9:47am UTC](https://community.postman.com/t/how-to-use-cryptojs-package-in-postman-flows-evaluate-block/74443 "2025-01-27T09:47:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![avionics-specialist3](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@avionics-specialist3](https://community.postman.com/u/avionics-specialist3)\
**Post date:** [January 27, 2025, 9:47am UTC](https://community.postman.com/t/how-to-use-cryptojs-package-in-postman-flows-evaluate-block/74443/1 "2025-01-27T09:47:32Z")

</div>

How can we use evaluate block in postman flows to validate the hmac signed payload. I’m using the below code

```auto
const crypto = require('crypto'); 
const secret = 'mySecretKey'; 
const payload = request.body; 
console.log(payload);
const receivedHmac = payload;
const data = JSON.stringify(payload); 
const generatedHmac = crypto.createHmac('sha256', secret).update(data).digest('hex');
if (receivedHmac === generatedHmac) { 
    console.log('Payload is valid'); 
    } else {
         console.log('Payload is not valid'); 
    }

```

This is throwing me an error invalid redefinition of global identifier.

---

<div class="post-metadata">

**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\
**Post date:** [January 27, 2025, 12:37pm UTC](https://community.postman.com/t/how-to-use-cryptojs-package-in-postman-flows-evaluate-block/74443/2 "2025-01-27T12:37:29Z")

</div>

“data” is a reserved variable, so I would change that to something else.

---

<div class="post-metadata">

**Author:** ![flows-daniel](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/flows-daniel/32/25516_2.png) [@flows-daniel](https://community.postman.com/u/flows-daniel)\
**Post date:** [January 28, 2025, 12:14am UTC](https://community.postman.com/t/how-to-use-cryptojs-package-in-postman-flows-evaluate-block/74443/3 "2025-01-28T00:14:32Z")

</div>

Hi @avionics-specialist3

We support the web crypto API in the evaluate block.

Try the below code:

```auto
const secret = 'mySecretKey';
const payload = request.body; 
console.log(payload);
const receivedHmac = 'expected_hmac_here'; 

const encoder = new TextEncoder();
const data = encoder.encode(payload)
  crypto.subtle.importKey('raw', new TextEncoder().encode(secret), {
    name: 'HMAC',
    hash: 'SHA-256',
  }, false, ['sign'])
    .then((key) => crypto.subtle.sign('HMAC', key, data))
    .then((signature) => {
      const generatedHmac = Array.from(new Uint8Array(signature)).map(byte => byte.toString(16).padStart(2, '0')).join('');
      return generatedHmac === receivedHmac;
    })
    .catch((error) => {return error});

```

If you want a constant time comparison function to compare the HMACs, you can use this function:

```auto
function constantTimeCompare(str1: string, str2: string): boolean {
    if (str1.length !== str2.length) {
        return false;
    }

    let result = 0;
    for (let i = 0; i < str1.length; i++) {
        result |= str1.charCodeAt(i) ^ str2.charCodeAt(i);
    }

    return result === 0;
}
constantTimeCompare(receivedHmac, generatedHmac)

```

The error you’re receiving in your code is in reference to trying to import the crypto library.

---

<div class="post-metadata">

**Author:** ![matthew-beck-cpc](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@matthew-beck-cpc](https://community.postman.com/u/matthew-beck-cpc)\
**Post date:** [March 27, 2025, 1:40pm UTC](https://community.postman.com/t/how-to-use-cryptojs-package-in-postman-flows-evaluate-block/74443/4 "2025-03-27T13:40:48Z")

</div>

Hi Daniel,

I am trying to verify signing keys in Postman. I was able to do this using CryptoJs:

```auto
const CryptoJS = require('crypto-js');
pm.test('JWT Signature is Valid', function () {
    let recreatedSignature;
    try {
        // Generate the hash using HMAC-SHA256 and encode to Base64
        recreatedSignature = CryptoJS.HmacSHA256(
                `${jwtHeaderEncoded}.${jwtPayloadEncoded}`,
                jwtSigningKey
            )
            .toString(CryptoJS.enc.Base64)
            .replace(/=*$/, '');
        console.log('recreatedSignature', recreatedSignature);
    }
    catch(e) {
        throw new Error('Could not recreate signature | ' + e)
    }
    
    pm.expect(jwtSignature).to.be.a('string').that.equals(recreatedSignature);
});

```

However, `require('crypto-js');` does not work for Newman tests, so I am trying to convert this to a Newman-friendly format.

I have not been able to implement this with your solution (modified for my purposes):

```auto
pm.test('JWT Signature is Valid', function () {
    let recreatedSignature;
    try {
        const encoder = new TextEncoder();
        const data = encoder.encode(`${jwtHeaderEncoded}.${jwtPayloadEncoded}`)
        crypto.subtle.importKey('raw', new TextEncoder().encode(jwtSigningKey), {
            name: 'HMAC',
            hash: 'SHA-256',
        }, false, ['sign'])
            .then((key) => crypto.subtle.sign('HMAC', key, data))
            .then((signature) => {
                recreatedSignature = _arrayBufferToBase64(signature);
                pm.expect(jwtSignature).to.be.a('string').that.equals(recreatedSignature);
            })
            .catch((error) => {console.log(error)});
    }
    catch(e) {
        throw new Error('Could not recreate signature | ' + e)
    }
});
// https://stackoverflow.com/a/9458996/27294094
function _arrayBufferToBase64( buffer ) {
    var binary = '';
    var bytes = new Uint8Array( buffer );
    var len = bytes.byteLength;
    for (var i = 0; i < len; i++) {
        binary += String.fromCharCode( bytes[i] );
    }
    return btoa( binary );
}

```

Furthermore, it looks like the Promise flow breaks the Chai tests - where it reports test success even when there is a failure.

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/5/8/58d04679f529d2270632bf5ce22a33d52b92492d.png)

---

<div class="post-metadata">

**Author:** ![flows-daniel](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/flows-daniel/32/25516_2.png) [@flows-daniel](https://community.postman.com/u/flows-daniel)\
**Post date:** [March 27, 2025, 5:54pm UTC](https://community.postman.com/t/how-to-use-cryptojs-package-in-postman-flows-evaluate-block/74443/5 "2025-03-27T17:54:13Z")

</div>

Hi @matthew-beck-cpc

Can you make this question a new post tagged with Newman since it isn’t about flows? It’s not my area of expertise but i’m sure the experts there will be able to help you 🙂