PromoFaux
September 12, 2018, 10:34am
2
Hi @Julian_Elve ,
So I have a method for validating the signature as follows:
public static string CalculateSignature(string payload, string signatureWithPrefix, string secret,
string shaPrefix)
{
if (!signatureWithPrefix.StartsWith(shaPrefix, StringComparison.OrdinalIgnoreCase))
{
return "Invalid shaPrefix";
}
var secretBytes = Encoding.UTF8.GetBytes(secret);
var payloadBytes = Encoding.UTF8.GetBytes(payload);
switch (shaPrefix)
{
case "sha1=":
using (var hmSha1 = new HMACSHA1(secretBytes))
{
var hash = hmSha1.ComputeHash(payloadBytes);
return $"{shaPrefix}{ToHexString(hash)}";
show original
You could probably simplify it a little to work specifically for Discourse webhooks, but I use it for both Discourse and Github hooks, so needed to be able to change out the sha<x>= part at the beginning.
For Discourse, it’s used like so:
Util.LogList(stuffToLog);
return StatusCode(400, error);
}
using (var reader = new StreamReader(Request.Body, Encoding.UTF8))
{
payloadText = await reader.ReadToEndAsync().ConfigureAwait(false);
}
var calcSig = Util.CalculateSignature(payloadText, signature, _config.Secret, "sha256=");
if (signature == calcSig)
{
var discourseHook = new DiscourseHook(eventId, eventType, eventName, signature, payloadText);
var matterHook = new MatterhookClient.MatterhookClient(_config.MattermostConfig.WebhookUrl);
HttpResponseMessage response = null;
MattermostMessage message = null;
if (discourseHook.EventName == "post_created")
{
Hope that helps some…!