0

Our company is going to be using a service called Spiff to send commission numbers to them and they will generate reports on it. They have multiple integration options but we are down to 3: manually uploading excel (not great but free), exporting our data into a CSV file and providing a SFTP site for them to upload from (have to provide SFTP and integration costs), or using their API to send data to (also free but we have to push the data). I'm not familiar with scripting but I am decent at VB.net so I'm trying to convert their example code over. The API documentation is at https://app.getguru.com/card/iXpEBagT/How-to-send-data-to-Spiffs-API and it's a little beyond me so I asked them for a screen shot example which they gave me:

// Spiff provided key
const key = "YourSecret";
// Seconds since epoch
const time = Math.floor(Date.now() / 1000);
const preDigestString = '${time}.${request.data}';
// HMAC SHA256 digest (must be lowercase)
const digest = CryptoJS.HmacSHA256(preDigestString, key).toString(CryptoJS.digest).toLowerCase()
const signature = 't=${time},v1=${digest}'
pm.request.headers.add({ key: 'Signature', value: signature })

So this is what I have but I don't know what to do about the toString(CryptoJS.digest) in VB.net:

Dim myKey As String = "12345678"   ' Fake test data
Dim myUnixTime As Double = (DateTime.UtcNow - New DateTime(1970, 1, 1, 0, 0, 0)).TotalSeconds
Dim myData As String = My.Computer.FileSystem.ReadAllText(FileNameTextBox.Text)  '  Fake test data
Dim myPreDigestString = $"${myUnixTime}.${myData}"

Dim myDigest As String = GetHMACSHA256Hash(myPreDigestString, myKey)
Dim mySignature As String = $"t=${myUnixTime},v1=${myDigest}"
Dim myHeader As String = $"key: 'Signature', value: {mySignature}"
Dim result_post = SendRequest(New Uri(URITextBox.Text), UTF8.GetBytes(myData), "application/json", "PUT", myHeader)

My SendRequest just takes the passed URL (their webhook), the data, and adds the header. The result I get every time is a (400) Bad Request so I have to be doing something wrong and I'm guessing it's the conversion to Digest that their example has that I'm having trouble reproducing?

Edit. My GetHMACSHA256Hash function:

Private Shared Function GetHMACSHA256Hash(ByVal text As String, ByVal key As String) As String
    Dim encoding As New ASCIIEncoding()
    Dim textBytes As Byte() = encoding.GetBytes(text)
    Dim keyBytes As Byte() = encoding.GetBytes(key)
    Dim hashBytes As Byte()
    Using hash As New HMACSHA256(keyBytes)
        hashBytes = hash.ComputeHash(textBytes)
    End Using
    Return BitConverter.ToString(hashBytes).Replace("-", "").ToLower()
End Function
ADY
  • 101
  • 1
  • 9
  • `CryptoJS.digest` in `.toString(CryptoJS.digest)` is simply ignored i. e. `.toString(CryptoJS.digest)` is identical to `.toString()`. So that's not the problem. Are the HmacSHA256 values the same for identical `preDigestString` values? If not, post *complete* test data. Btw, the Implementation of `GetHMACSHA256Hash()` is missing. – Topaco Jan 04 '22 at 19:32
  • I added my function which was based on the answer here https://stackoverflow.com/questions/47686677/how-to-generate-hmac-sha256-in-net-core Also referenced https://stackoverflow.com/questions/12185122/calculating-hmacsha256-using-c-sharp-to-match-payment-provider-example – ADY Jan 04 '22 at 20:01
  • 1
    According to my tests the HmacSHA256 values of both codes are identical if the same input data (`preDigestString`, `key`) are used. If this is not the case for you, post test data. Possibly the problem is more in the format of the sent data or in the transmitting itself, i.e. in the `SendRequest` part, which unfortunately I can't help with. – Topaco Jan 04 '22 at 20:15
  • Thank you for verifying. There must be more going on then, I'll have to go back to them and ask for more clarification. – ADY Jan 04 '22 at 20:28

0 Answers0