无法使用bambooHR 的时间戳验证 webhook

Question

我正在尝试验证来自竹子的 webhook。文档在这里https://documentation.bamboohr.com/docs/webhooks

打开标题后，我看到了这个：

• X-BambooHR-签名：362cb0eff0193af8d3f939349f84014e5c70bba4cfc105682b45ecd305db01ff
• X-BambooHR-时间戳：1652747163

这是我的代码，来自 webhook 触发的 azure 函数。 testOutput 不是“X-BambooHR-Signature”标头中的内容：

            string data;
            using (var reader = new StreamReader(req.Body))
            {
                 data = await reader.ReadToEndAsync();
            }

            string privateKey = "<gotten from bamboohr webhookconfig>";
            if (req.Headers.Keys.Contains("X-BambooHR-Signature") && req.Headers.Keys.Contains("X-BambooHR-Timestamp"))
            {

                string timestamp = req.Headers["X-BambooHR-Timestamp"];
                string signature = req.Headers["X-BambooHR-Signature"];
                byte[] privateKeyBytes = Encoding.UTF8.GetBytes(privateKey);
                byte[] combinedBytes = Encoding.UTF8.GetBytes(data + timestamp);
                HMACSHA256 hmac = new HMACSHA256(privateKeyBytes);
                byte[] testOutputBytes = hmac.ComputeHash(combinedBytes);
                string testOutput = Convert.ToBase64String(testOutputBytes);
                log.LogInformation("testOutput is: " + testOutput);  //----NOT EQUAL TO signature.

            }

知道我可能做错了什么吗？ testUutput 类似于 'llBdZd2IfVdrJBlkGFF​​NG2dszDxpgJlJ4vQqTATJsYU=' ，如您所见，它甚至不接近。

Answer 1

不要使用ToBase64String，而是尝试将其转换为十六进制格式。 （有different ways 来转换它。）我在python 中验证bambooHR 签名密钥时遇到了类似的问题，并通过将预期签名转换为十六进制格式（不是字节或字节字符串）来修复它。

c#

using System;
using System.Text;
using System.Security.Cryptography;


namespace Test
{
    public class VerifySignature
    {
        public static void Main(string[] args)
        {
            string data = "request data";
            string privateKey = "your private key";
            string timestamp = "1652747163";
            string signature = "362cb0eff0193af8d3f939349f84014e5c70bba4cfc105682b45ecd305db01ff";
            byte[] privateKeyBytes = Encoding.UTF8.GetBytes(privateKey);
            byte[] combinedBytes = Encoding.UTF8.GetBytes(data + timestamp);
            HMACSHA256 hmac = new HMACSHA256(privateKeyBytes);
            byte[] testOutputBytes = hmac.ComputeHash(combinedBytes);
            // edited from here
            // string testOutput = Convert.ToBase64String(testOutputBytes);
            // log.LogInformation("testOutput is: " + testOutput);
            string hexOutput = BitConverter.ToString(testOutputBytes).Replace("-",""); // convert to hexadecimal format
            Console.WriteLine(hexOutput);

        }
    }
}

蟒蛇

import hmac
from hashlib import sha256

def verify_signature(request):
    received_signature = 'get sig from request headers'
    timestamp = 'get timestamp from request headers'
    private_key = 'your private key'
    body = request.body
    calculated_signature = hmac.new(
        private_key, body + timestamp, sha256
    ).hexdigest()

    return received_signature == calculated_signature
    

我希望这会有所帮助，虽然有点晚了！