使用 C# 验证来自 Slack Events API 的请求

Question

This example in the Slack documentation uses a form-url-encoded body but the Slack Events Api sends json. I've attempted to implement the pseudo code in the example with the C# crypto namespace. Not able to get a matching signature.

When I inspect the request body in C# it includes escaping for the quote (") characters which I'm pretty sure aren't in the request body when it's hashed on the Slack side. How can I know that my raw version of the request body matches what Slack used to create the hash? Is there something wrong with the way I'm using the HMACSHA256? Also looked at this but found nothing that I could extrapolate to C#.

{
...
    string signingKey = ConfigurationManager.AppSettings["Slack:SigningSecret"].ToString();            
    string timestamp = GetHeaderValue(actionContext, "X-Slack-Request-Timestamp");            
    string SlackSignature = GetHeaderValue(actionContext, "X-Slack-Signature");

    var app = HttpContext.Current;
    string requestBody = string.Empty;
    using (var stream = new MemoryStream())
    {
        app.Request.InputStream.Seek(0, SeekOrigin.Begin);
        app.Request.InputStream.CopyTo(stream);
        requestBody = Encoding.UTF8.GetString(stream.ToArray());                
        app.Request.InputStream.Seek(0, SeekOrigin.Begin);                
    }  

    string sig_basestring = "v0:" + timestamp + ":" + requestBody;
    var hmac256 = HMACSHA256.Create();
    hmac256.Key = Encoding.ASCII.GetBytes(signingKey);
    var sig_hash = 
    hmac256.ComputeHash(Encoding.ASCII.GetBytes(sig_basestring));

    var computedSignature = "v0=" + ToHex(sig_hash, false);
    bool isValidRequest = SlackSignature.Equals(computedSignature);

    if (!isValidRequest)
    {
        throw new HttpResponseException(HttpStatusCode.Forbidden);
    }
...
}

private string ToHex(byte[] bytes, bool upperCase) 
{
    var result = new StringBuilder(bytes.Length * 2)
    for (int i = 0; i < bytes.Length; i++)
            result.Append(bytes[i].ToString(upperCase ? "X2" : "x2"));
        return result.ToString();
    }

Answer 1

I came across SlackNet and found the solution that works:

var encoding = new UTF8Encoding();
using (var hmac = new HMACSHA256(encoding.GetBytes(signingSecret)))
{
    var hash = hmac.ComputeHash(encoding.GetBytes($"v0:{timestamp}:{requestBody}"));
    var hashString = $"v0={BitConverter.ToString(hash).Replace("-", "").ToLower(CultureInfo.InvariantCulture)}";
    if (hashString.Equals(SlackSignature)) return continuation();
}
...