Xero - 意向接收红宝石

Question

这是来自 Xero 的参数

{"events"=>nil,
 "firstEventSequence"=>0,
 "lastEventSequence"=>0,
 "entropy"=>"KFDXIMNLPDAMRBOEVAVF",
 "controller"=>"admin/billing/webhooks",
 "action"=>"handle_hook",
 "webhook"=>
  {"events"=>nil,
   "firstEventSequence"=>0,
   "lastEventSequence"=>0,
   "entropy"=>"KFDXIMNLPDAMRBOEVAVF"}}

我想验证Intent To Receive https://developer.xero.com/documentation/webhooks/configuring-your-server#intent

data = {"events"=>nil, "firstEventSequence"=>0, "lastEventSequence"=>0, "entropy"=>"KFDXIMNLPDAMRBOEVAVF"}

Key = HRj6QPub9BNE4MWewrcLrkKFjpiikV1KrlMZCvDawyDR95MGkkuE2y1DXFP1tifsEWaJygLx6zG0r9rXVTflcg==

下面尝试过

Base64.encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new('sha256'), key, data)).strip()

*** TypeError Exception: no implicit conversion of ActionController::Parameters into String

或者

hash  = OpenSSL::HMAC.digest('sha256', key, data)
*** TypeError Exception: no implicit conversion of ActionController::Parameters into String

在这里如何实现这一目标？

为了确保您收到的请求来自 Xero，您需要验证 x-xero-signature 标头中提供的签名。创建或重新启用 Webhook 订阅（或更新订阅 URL）时，系统将提示用户启动“接收意图”验证。此验证过程将是对订阅中提供的 url 的一系列 HTTPS POST 请求。

编辑 Rails 正在将空白数组转换为 nil，所以我自己制作了有效负载，根据文档看起来完全相同

data = params[:webhook]

payload = {
             "events": [],
             "lastEventSequence": data[:lastEventSequence],
             "firstEventSequence": data[:firstEventSequence],
             "entropy": data[:entropy]
          }

Answer 1

经过研究和调试代码终于找到了一种方法来做到这一点

  def handle_hook
    key = ENV['XERO_WEBHOOK_KEY']
    payload = request.body.read
    calculated_hmac = Base64.encode64(OpenSSL::HMAC.digest('sha256', key, payload))
    if calculated_hmac.strip() == request.headers['x-xero-signature']
      head :ok
    else
      head :unauthorized
    end
  end

使用 Strip() 在这里很神奇