Shopify Webhook HMAC Validation problem in c#

[MehmetHollyPalm]

Hi

In .net 8 app I wanna validate webhook's payload for security. 

Here is the my code and always return false because of my calculation and hmac header doesn't match.

private bool ValidateHash(ActionExecutingContext actionContext)
{
    actionContext.HttpContext.Request.Body.Position = 0;
    using var stream = new MemoryStream();
    actionContext.HttpContext.Request.Body.CopyToAsync(stream).Wait();
    var requestBody = Encoding.UTF8.GetString(stream.ToArray());
    var svc = actionContext.HttpContext.RequestServices;
    var shopifySettings = svc.GetService<IOptions<ShopifySettings>>()?.Value;
    var keyBytes = Encoding.UTF8.GetBytes(shopifySettings.ApiSecretKey);
    var dataBytes = Encoding.UTF8.GetBytes(requestBody);
    var hmac = new HMACSHA256(keyBytes);
    var hmacBytes = hmac.ComputeHash(dataBytes);
    var hmacHeader = actionContext.HttpContext.Request.Headers["x-shopify-hmac-sha256"];
    var createSignature = Convert.ToBase64String(hmacBytes);
    return hmacHeader == createSignature;
}

Also I buffered my http request for reliable streaming

app.Use(next => context =>
{
    context.Request.EnableBuffering();
    return next(context);
});

Please help me. 

Regards,

[Liam]

Hi MehmetHollyPalm,

Some techniques you could try are:

• Ensure the request body is reset correctly after reading.
• Properly handle async methods with await instead of .Wait().
• Read the request body as a stream.
• Ensure the HMACSHA256 computation and header comparison are correctly handled.

Try the above and let us know if you're still seeing issues. 

[MehmetHollyPalm]

Hi Liam,

I've tried eveything what u suggest. But result is same 

Do u have any change to share some working code example for this situation? Or try my code?

Regards

[MehmetHollyPalm]

And I saw an interesting section in my shop settings.

It says that

Your webhooks will be signed with 40376XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (I replaced real chars with X)

But in documentation Shopify says your hmac header encrypted with your "api secret key"

I tried bot of them but can't get result.

Regards

[MehmetHollyPalm · Accepted solution]

I figured out a valid solution

I replaced string to stream for base64 and create webhook from apis not from shop's admin page. 

And everything work as expected