How to transport data from Javascript to PHP?

Question

In Javascript I have:

function authenticateAndFetch(payload) {
  const endpoint = PropertiesService.getScriptProperties().getProperty('WEBHOOK_URL');
  const hmac_key = PropertiesService.getScriptProperties().getProperty('HMAC_SHA_256_KEY');
  var send_data = JSON.stringify(payload)
  const signature = Utilities.computeDigest(Utilities.DigestAlgorithm.MD5, send_data)
    .map(function(chr){return (chr+256).toString(16).slice(-2)})
    .join(''); // Golf https://stackoverflow.com/a/49759368/300224
  const fetch_options = {
    'method': 'post',
    'payload': {'gmail_details': send_data, 'signature': signature},
    'muteHttpExceptions': true
  };
  const response = UrlFetchApp.fetch(endpoint, fetch_options);
  return response.getContentText();
}

Then in PHP I validate this with:

$detailsString = $_POST['gmail_details'];
$correctSignature = md5($detailsString);

After some logging, and a long day, I found out that Javascript and PHP will produce different md5 sums for a string including this data:

HEX: 65 20 c2 97 20 44                              

Is there some way to sanitize the inputs in Javascript before sending them to PHP, or is there some way to get matching strings in both environments?

Answer 1

I never fixed the actual problem. And think minimizing the question will lead to a bug report on Google App Script or PHP. But here is a workaround that let's me keep moving, and it is highly inefficient:

function authenticateAndFetch(payload) {
  const endpoint = PropertiesService.getScriptProperties().getProperty('WEBHOOK_URL');
  const hmac_key = PropertiesService.getScriptProperties().getProperty('HMAC_SHA_256_KEY');
  var send_data = JSON.stringify(payload);
  send_data = Utilities.base64Encode(send_data); // https://stackoverflow.com/q/51866469/300224
  const signature = Utilities.computeDigest(Utilities.DigestAlgorithm.MD5, send_data)
    .map(function(chr){return (chr+256).toString(16).slice(-2)})
    .join(''); // Golf https://stackoverflow.com/a/49759368/300224


  const fetch_options = {
    'method': 'post',
    'payload': {'gmail_details': send_data, 'signature': signature},
    'muteHttpExceptions': true
  };
  const response = UrlFetchApp.fetch(endpoint, fetch_options);
  return response.getContentText();
}

And PHP

$detailsString = $_POST['gmail_details'];
$detailsString = base64_decode($_POST['gmail_details']);
$correctSignature = md5($detailsString);

In summary, you can't reliably transfer non-ASCII from Javascript to PHP so just base64 encode everything.