I am seeking assistance in verifying a test shopify webhook for a private app in ASP.NET MVC. When generating/calculating the digital signature hash, it creates a value that conflicts with the expected result. We have tried implementing code from this link here to create the matching values for the verification process. https://community.shopify.com/c/Shopify-APIs-SDKs/How-can-I-create-a-matching-HMAC-value-to-verify-a...
Attached below is a trimmed down version of the code we use that goes over all of the relevant parts. If anything seems omitted that might cause such issues, any help to address those would be greatly appreciated.
//begin code
var inputStream = HttpContext.Current.Request.InputStream;
inputStream.Position = 0;
string requestBody = await new StreamReader(inputStream).ReadToEndAsync();
Log.Error("read the request body");
Log.Error(requestBody);
var hmacHeaderValues = Request.Headers.FirstOrDefault(kvp => kvp.Key.Equals("X-Shopify-Hmac-SHA256", StringComparison.OrdinalIgnoreCase)).Value;
if (hmacHeaderValues.Count() < 1)
{
Log.Error("could not find X-Shopify-Hmac-SHA256");
return false;
}
string hmacHeader = hmacHeaderValues.First();
HMACSHA256 hmac = new HMACSHA256(Encoding.UTF8.GetBytes(System.Configuration.ConfigurationManager.AppSettings["AppSecret"]));
string hash = Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(requestBody)));
Log.Error("Generated: " + hash);
Log.Error("Comparing to: " + hmacHeader);
if (hash != hmacHeader)
{
Log.Error("Given and generated hash values did not match");
return false;
}
return true;
//end code
