sha1 hmac hexdigest signature

main.go

package main

import (
	"crypto/hmac"
	"crypto/sha1"
	"encoding/hex"
	"fmt"
	"os"
)

func generateSignature(secretToken, payloadBody string) string {
	mac := hmac.New(sha1.New, []byte(secretToken))
	mac.Write([]byte(payloadBody))
	expectedMAC := mac.Sum(nil)
	return "sha1=" + hex.EncodeToString(expectedMAC)
}

func main() {
	var testPayloadBody = `{"message":"test content"}`
	fmt.Println("signature:", generateSignature(os.Getenv("SECRET_TOKEN"), testPayloadBody))
}

main.rb

require 'openssl'

test_payload_body='{"message":"test content"}'


def generate_signature(secret_token, payload_body)
    return 'sha1=' + OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha1'), secret_token, payload_body)
end

puts "signature: #{generate_signature(ENV['SECRET_TOKEN'], test_payload_body)}"

To compare signatures use constant time compares:

• Ruby: Rack::Utils.secure_compare (https://www.rubydoc.info/gems/rack/Rack/Utils.secure_compare)
• Go: https://golang.org/pkg/crypto/hmac/#Equal or subtle.ConstantTimeCompare (https://golang.org/pkg/crypto/subtle/#ConstantTimeCompare)

YOUR CODE WORKS LIKE A CHARM!

YOUR CODE WORKS LIKE A CHARM!

Awesome to hear @rayxyz ;)