Recent searches


No recent searches

Trouble with Verifying Webhook Authenticity in Powershell?



Posted May 14, 2024

I'm trying to use Powershell to action on a webhook from Zendesk, and the code seems to be working with an incorrect result. I'm basing this all off of the article here, though obviously I've had to figure things out in Powershell based on the info from that page.

This is the code:

param
(
    [Parameter(Mandatory=$false)]
    [object] $WebhookData
)


$zenSignSecret = [System.Text.Encoding]::Default.GetBytes("[redacted]")
$zenSig64 = $WebhookData.RequestHeader.'X-Zendesk-Webhook-Signature'
$zenTimeStamp = $WebhookData.RequestHeader.'X-Zendesk-Webhook-Signature-Timestamp'.ToString()



write-output "Request Body: " $WebhookData.RequestBody.ToString()
write-output "Time Stamp: $zenTimeStamp"
write-output "Match to the original signature: " $zenSig64


$hmacsha = [System.Security.Cryptography.HMACSHA256]::new()
$hmacsha.Key = $zenSignSecret


$signatureBytes = $hmacsha.ComputeHash(
    [System.Text.Encoding]::Default.GetBytes(
        $zenTimeStamp +
        $WebhookData.RequestBody
    )
)
$signature = [Convert]::ToBase64String($signatureBytes)
write-output "Computed Signature: " $signature

This results in the following output:

Request Body: 

{
      "ticket": {
        "id": 35436,
        "priority": "high",
        "status": "open",
        "subject": "Help, my printer is on fire!",
        "description": "The fire is very colorful.",
        "tags": [
          "enterprise",
          "other_tag"
        ]
      }
    }

Time Stamp: 5/14/2024 8:21:11 AM

Match to the original signature: 

kzkmxu8gYUKvY0V7DDCEbl2E/1bk/OHJ27X/kgUZU1Y=

Computed Signature: 

ondHh8z8O1KthJmjtGZcPbaM1yl3puibG7mjkzydFYE=

I'm sure it's something silly, like the datatype of the variables or something, since the computed signature looks like it's created properly and it's just not the right value.


0

0

0 comments

Please sign in to leave a comment.

Didn't find what you're looking for?

New post