i want to verify slack APIS commands and interactive endpoints i followed the documentation as here https://api.slack.com/authentication/verifying-requests-from-slack
and tried to convert it to C# code and this function
private bool VerifySlackRequest(HttpRequest request, IHeaderDictionary headers,
StringValues slackSignatureHeader)
{
string SlackSigningSecret = ConfigurationHelper.SlackSigningSecret;
DateTime timestamp = DateTimeOffset.FromUnixTimeSeconds(timestampUnix).UtcDateTime;
DateTime currentTimestamp = DateTime.UtcNow;
if (Math.Abs((currentTimestamp - timestamp).TotalSeconds) > 60 * 5)
{
// The request timestamp is more than five minutes from local time.
// It could be a replay attack, so let's ignore it.
return false;
}
// Get the request body as a URL-encoded string
string requestBody = string.Join("&", request.Form.Select(kvp => $"{kvp.Key}={kvp.Value}"));
var encoding = new UTF8Encoding();
using (var hmac = new HMACSHA256(encoding.GetBytes(SlackSigningSecret)))
{
var hash = hmac.ComputeHash(encoding.GetBytes($"v0:{headers["X-Slack-Request-Timestamp"]}:{requestBody}"));
var hashString = $"v0={BitConverter.ToString(hash).Replace("-", "").ToLower(CultureInfo.InvariantCulture)}";
if (hashString.Equals(slackSignatureHeader)) return true;
else return false;
}
}
and here is how i call the function
bool isValidRequest = VerifySlackRequest(Request, Request.Headers, slackSignatureHeader);
if (!isValidRequest)
{
return Unauthorized("Invalid request signature");
}
i make sure about the SlackSigningSecret but the slackSignatureHeader and the hashString always not get match