# חוסר התאמה בקידוד ה-hash של DiscourseConnect

**URL:** <https://meta.discourse.org/t/discourseconnect-payload-hash-encoding-mismatch/192319>\
**Category:** SSO\
**Created:** [1 ביוני,‏ 2021,‏ 5:52pm UTC](https://meta.discourse.org/t/discourseconnect-payload-hash-encoding-mismatch/192319 "2021-06-01T17:52:09Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [1 ביוני,‏ 2021,‏ 6:01pm UTC](https://meta.discourse.org/t/discourseconnect-payload-hash-encoding-mismatch/192319/2 "2021-06-01T18:01:50Z")

</div>

Can you share an example payload, the hash which you get, and the secret? (make sure to change the secret on your test site before posting it here)

> [@Bio](#):
>
> (newline omitted)

Newlines are important, and will affect the signature. It looks like [Generate and verify HMAC Online - SHA-256, SHA-384, SHA-512](https://www.devglan.com/online-tools/hmac-sha256-online) strips newlines before calculating the hash. You might have better luck with another tool like [Free Online HMAC Generator / Checker Tool (MD5, SHA-256, SHA-512) - FreeFormatter.com](https://www.freeformatter.com/hmac-generator.html)

~~Also, you need to calculate the HMAC of the **url-encoded** base64 payload. So you should never be calculating the hash of a payload including a raw newline.~~

 

~~Instead, it should be `%0A`. If you’re using a web framework, bear in mind that it may have un-encoded the payload automatically. You will need to find a way to disable this, or re-encode the value.~~

---

_[View the full topic](https://meta.discourse.org/t/discourseconnect-payload-hash-encoding-mismatch/192319)._