6 ms·
But the returned signed string will be an HMAC-SHA256 hash, won't it? Then there's not going to be any '\n' or '\\n's in there. Only thing you'll be able to tel
by lillesvin 10mo ago
But the returned signed string will be an HMAC-SHA256 hash, won't it? Then there's not going to be any '\n' or '\\n's in there. Only thing you'll be able to tell is if it matches your hash or not, in which case 'OK' or 'not OK' will work just as well.
Or am I misunderstanding you?
- kichik 10mo agoYou are indeed misunderstanding me. I am talking about returning the entire string to be signed. Not the result of the signature.
- lillesvin 10mo agoAh, my bad. Sorry. But couldn't you then just make the call to an echo service (like HTTPbin) or simply dump the request when you send it?
- kichik 10mo agoThe echo server will have no knowledge on how to construct the string to be signed.
- lillesvin 10mo agoBut neither does the actual server. HMAC only verifies that the message is from whoever it claims to be from and that it is intact. It won't know what you intended the body of the request to look like.