Message Verification

[Ardento]

We have been implementing an integration app to sync data between simpro and another third party application using simPRO webhook. The system hosted on AWS API gateway and need to authorize the message coming from the simPRO webhook. The AWS authorization function is a ".net core" function that hashes the request body using the webhook's secret. However, every time we receive the payload, it denies returning 200 response because the secrets are not the same. The API document mentioned that the response body needs to be hashed with the secret and what we hash is the below payload using the secret:

{
"ID": "site.updated",
"build": "CompanyName.simprosuite.com",
"description": "Site #9230 has been updated.",
"name": "Site",
"action": "updated",
"reference": {
"companyID": 7,
"siteID": 9230
},
"date_triggered": "2021-02-15T10:20:56\u002B10:00"
}
The question is, what is the response body? What do we need to hash instead of the above payload?

Regards,

[Muqeet]

Please follow the similar logic described below in your preferred programming language.

Code: Select all

$webhookSecret = 'SECRET'; // Defined in webhook setup
$headerSignatureHash = $headers['X-Response-Signature']; // Webhook message header

/** @var $message webhook request body */
if (!hash_equals($headerSecret, hash_hmac('sha1', $message, $webhookSecret))) {
    throw new \Exception('Hashes do not match');
}

// Continue processing the webhook
...
...

The response body (which should be referred correctly as request body) is the json data which needs to be hashed with the secret given during webhook setup.

[Muqeet]

Make sure the request body is converted to json encoded string if its not already.

[Ardento]

Thanks for your response. The issue is the SHA1 algorithm is different from PHP. Have you got a solution or code example to fix this issue?

Best regards,
Amir

[Muqeet]

You need to look for a solution to hash the json encoded string with SHA1 algorithm in your preferred programming language.

[amchconsult]

Does anyone have an example for node.js?
thank you

[tonyo]

Any java examples available?