عدم تطابق تجزئة حمولة DiscourseConnect

Can you share an example payload, the hash which you get, and the secret? (make sure to change the secret on your test site before posting it here)

Newlines are important, and will affect the signature. It looks like HMAC-SHA256 Hash Generator | Devglan strips newlines before calculating the hash. You might have better luck with another tool like Free Online HMAC Generator / Checker Tool (MD5, SHA-256, SHA-512) - FreeFormatter.com

Also, you need to calculate the HMAC of the url-encoded base64 payload. So you should never be calculating the hash of a payload including a raw newline.

Instead, it should be %0A. If you’re using a web framework, bear in mind that it may have un-encoded the payload automatically. You will need to find a way to disable this, or re-encode the value.

3 إعجابات