Hello.
I have a problem with understanding what documentation means when it mentions “(raw) payload body” during HMAC verification:
https://developer.mautic.org/?json#authenticity-verification
I have a raw body like that:
{"mautic.lead_post_save_new":[{"contact":{"isPublished":true,"dateAdded":"2017-06-19T09:31:18+00:00","dateModified":null,"createdBy":1,"createdByUser":"John Doe","modifiedBy":null,"modifiedByUser":null,"id":52,"points":0,"color":null,"fields":{"core":{"timezone1":{"id":46,"group":"core","label":"timezone","alias":"timezone1","type":"timezone","value":"Europe\/Prague"},"datetime":{"id":45,"group":"core","label":"datetime","alias":"datetime","type":"datetime","value":""},"boolean":{"id":44,"group":"core","label":"boolean","alias":"boolean","type":"boolean","value":null},"f_select":{"id":43,"group":"core","label":"select","alias":"f_select","type":"select","value":null},"multiselect":{"id":42,"group":"core","label":"Multiselect","alias":"multiselect","type":"multiselect","value":"php|js"},"title":{"id":1,"group":"core","label":"Title","alias":"title","type":"lookup","value":"Mr."},"firstname":{"id":2,"group":"core","label":"First Name","alias":"firstname","type":"text","value":"John"},"lastname":{"id":3,"group":"core","label":"Last Name","alias":"lastname","type":"text","value":"Doe"},"company":{"id":4,"group":"core","label":"Company","alias":"company","type":"text","value":null},"position":{"id":5,"group":"core","label":"Position","alias":"position","type":"text","value":null},"email":{"id":6,"group":"core","label":"Email","alias":"email","type":"email","value":"john@doe.name"},"mobile":{"id":7,"group":"core","label":"Mobile","alias":"mobile","type":"tel","value":null},"phone":{"id":8,"group":"core","label":"Phone","alias":"phone","type":"tel","value":null},"fax":{"id":9,"group":"core","label":"Fax","alias":"fax","type":"tel","value":null},"address1":{"id":10,"group":"core","label":"Address Line 1","alias":"address1","type":"text","value":null},"address2":{"id":11,"group":"core","label":"Address Line 2","alias":"address2","type":"text","value":null},"city":{"id":12,"group":"core","label":"City","alias":"city","type":"text","value":"Prague"},"state":{"id":13,"group":"core","label":"State","alias":"state","type":"region","value":null},"zipcode":{"id":14,"group":"core","label":"Zip Code","alias":"zipcode","type":"text","value":"16000"},"country":{"id":15,"group":"core","label":"Country","alias":"country","type":"country","value":"Czech Republic"},"preferred_locale":{"id":16,"group":"core","label":"Preferred Locale","alias":"preferred_locale","type":"locale","value":"cs_CZ"},"attribution_date":{"id":17,"group":"core","label":"Attribution Date","alias":"attribution_date","type":"datetime","value":"2017-06-14 11:30:00"},"attribution":{"id":18,"group":"core","label":"Attribution","alias":"attribution","type":"number","value":32},"website":{"id":19,"group":"core","label":"Website","alias":"website","type":"url","value":null}},"social":{"facebook":{"id":20,"group":"social","label":"Facebook","alias":"facebook","type":"text","value":null},"foursquare":{"id":21,"group":"social","label":"Foursquare","alias":"foursquare","type":"text","value":null},"instagram":{"id":23,"group":"social","label":"Instagram","alias":"instagram","type":"text","value":null},"linkedin":{"id":24,"group":"social","label":"LinkedIn","alias":"linkedin","type":"text","value":null},"skype":{"id":25,"group":"social","label":"Skype","alias":"skype","type":"text","value":null},"twitter":{"id":26,"group":"social","label":"Twitter","alias":"twitter","type":"text","value":null}},"personal":[],"professional":[]},"lastActive":null,"owner":{"createdByUser":null,"modifiedByUser":null,"id":1,"username":"admin","firstName":"John","lastName":"Doe"},"ipAddresses":[],"tags":[[]],"utmtags":null,"stage":null,"dateIdentified":"2017-06-19T09:31:18+00:00","preferredProfileImage":"gravatar","doNotContact":[],"frequencyRules":[]},"timestamp":"2017-06-19T09:31:18+00:00"}],"mautic.lead_post_save_update":[{"contact":{"isPublished":true,"dateAdded":"2017-06-19T09:31:18+00:00","dateModified":"2017-06-19T09:32:24+00:00","createdBy":1,"createdByUser":"John Doe","modifiedBy":1,"modifiedByUser":"John Doe","id":52,"points":0,"color":null,"fields":{"core":{"title":{"id":"1","label":"Title","alias":"title","type":"lookup","group":"core","object":"lead","is_fixed":"1","value":"Mr."},"firstname":{"id":"2","label":"First Name","alias":"firstname","type":"text","group":"core","object":"lead","is_fixed":"1","value":"John"},"lastname":{"id":"3","label":"Last Name","alias":"lastname","type":"text","group":"core","object":"lead","is_fixed":"1","value":"Doe"},"company":{"id":"4","label":"Company","alias":"company","type":"text","group":"core","object":"lead","is_fixed":"1","value":"Mautic"},"position":{"id":"5","label":"Position","alias":"position","type":"text","group":"core","object":"lead","is_fixed":"1","value":null},"email":{"id":"6","label":"Email","alias":"email","type":"email","group":"core","object":"lead","is_fixed":"1","value":"john@doe.name"},"mobile":{"id":"7","label":"Mobile","alias":"mobile","type":"tel","group":"core","object":"lead","is_fixed":"1","value":"333444555"},"phone":{"id":"8","label":"Phone","alias":"phone","type":"tel","group":"core","object":"lead","is_fixed":"1","value":null},"fax":{"id":"9","label":"Fax","alias":"fax","type":"tel","group":"core","object":"lead","is_fixed":"0","value":null},"address1":{"id":"10","label":"Address Line 1","alias":"address1","type":"text","group":"core","object":"lead","is_fixed":"1","value":null},"address2":{"id":"11","label":"Address Line 2","alias":"address2","type":"text","group":"core","object":"lead","is_fixed":"1","value":null},"city":{"id":"12","label":"City","alias":"city","type":"text","group":"core","object":"lead","is_fixed":"1","value":"Prague"},"state":{"id":"13","label":"State","alias":"state","type":"region","group":"core","object":"lead","is_fixed":"1","value":null},"zipcode":{"id":"14","label":"Zip Code","alias":"zipcode","type":"text","group":"core","object":"lead","is_fixed":"1","value":"16000"},"country":{"id":"15","label":"Country","alias":"country","type":"country","group":"core","object":"lead","is_fixed":"1","value":"Czech Republic"},"preferred_locale":{"id":"16","label":"Preferred Locale","alias":"preferred_locale","type":"locale","group":"core","object":"lead","is_fixed":"1","value":"cs_CZ"},"attribution_date":{"id":"17","label":"Attribution Date","alias":"attribution_date","type":"datetime","group":"core","object":"lead","is_fixed":"1","value":"2017-06-14 11:30:00"},"attribution":{"id":"18","label":"Attribution","alias":"attribution","type":"number","group":"core","object":"lead","is_fixed":"1","value":32},"website":{"id":"19","label":"Website","alias":"website","type":"url","group":"core","object":"lead","is_fixed":"0","value":null},"multiselect":{"id":"42","label":"Multiselect","alias":"multiselect","type":"multiselect","group":"core","object":"lead","is_fixed":"0","value":"php|js"},"f_select":{"id":"43","label":"select","alias":"f_select","type":"select","group":"core","object":"lead","is_fixed":"0","value":null},"boolean":{"id":"44","label":"boolean","alias":"boolean","type":"boolean","group":"core","object":"lead","is_fixed":"0","value":null},"datetime":{"id":"45","label":"datetime","alias":"datetime","type":"datetime","group":"core","object":"lead","is_fixed":"0","value":""},"timezone1":{"id":"46","label":"timezone","alias":"timezone1","type":"timezone","group":"core","object":"lead","is_fixed":"0","value":"Europe\/Prague"}},"social":{"facebook":{"id":"20","label":"Facebook","alias":"facebook","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"foursquare":{"id":"21","label":"Foursquare","alias":"foursquare","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"instagram":{"id":"23","label":"Instagram","alias":"instagram","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"linkedin":{"id":"24","label":"LinkedIn","alias":"linkedin","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"skype":{"id":"25","label":"Skype","alias":"skype","type":"text","group":"social","object":"lead","is_fixed":"0","value":null},"twitter":{"id":"26","label":"Twitter","alias":"twitter","type":"text","group":"social","object":"lead","is_fixed":"0","value":null}},"personal":[],"professional":[]},"lastActive":null,"owner":{"createdByUser":null,"modifiedByUser":null,"id":1,"username":"admin","firstName":"John","lastName":"Doe"},"ipAddresses":[],"tags":[[]],"utmtags":[],"stage":null,"dateIdentified":"2017-06-19T09:31:18+00:00","preferredProfileImage":"gravatar","doNotContact":[],"frequencyRules":[]},"timestamp":"2017-06-19T09:32:24+00:00"}],"timestamp":"2021-04-14T12:04:30+00:00"};
with secret zzzazz and signature Dl7f5cvwZzMKL6JJRSyDWdycp/JWJr0LCAfkqxPqPFs=
The generated signature is IXiLxrthxSLyrsB3NZaaPB2mfXkdEncbcM+FAwbaj+g=
I tried calculating this with php:
base64_encode(hash_hmac('sha256', $message, $secret, true));
and java:
public String hmac(final String secret, final String message) {
Mac sha256HMAC;
try {
final byte byteKey = secret.getBytes(StandardCharsets.UTF_8);
sha256HMAC = Mac.getInstance(HMAC_SHA256);
SecretKeySpec keySpec = new SecretKeySpec(byteKey, HMAC_SHA256);
sha256HMAC.init(keySpec);
byte macData = sha256HMAC.doFinal(message.getBytes(StandardCharsets.UTF_8));
return Base64.getEncoder().encodeToString(macData);
} catch (InvalidKeyException | NoSuchAlgorithmException e) {
e.printStackTrace();
}
return null;
}
Results are however the same, the generated signature never match.
Can I ask what exactly “raw payload body” is?
EDIT:
It seems that block of preformatted text is not working