Hi,
Can someone explain to me the exact method that is used to generate the HMAC signatures for the webhook events. Without this information I am unable to verify the signature of messages sent by qualtrics. The API documentation seems incomplete in this area.
The first question is how does the shared key which is specified as a string correspond to a 16 byte or 32 byte key for signing and encryption?
Then when we get the HMAC signature in webhook messages, this is a 128 character hex number. What algorithm is used to generate this signature?
Finally, how is the webhook payload converted to a byte array for signing by the shared key?
For example, this is one of my attempts to verify these signatures:
//specify the shared key in some format
var key = "0000000000000000000000000000000000000000000000000000000000000000";
var createSubscriptionPayload = new CreateSubscriptionPayload()
{
topics = $"surveyengine.completedResponse.{Configuration["surveyId"]}",
encrypt = false,
publicationUrl = Configuration["webHookUrl"],
sharedKey = key,
};
//create a subscription using this key
var result = await createSubscription(createSubscriptionPayload);
An example payload we receive for the above subscription is:
Topic=peopleplus.surveyengine.completedResponse.SV_cVn9uBwheR9hz01&HMAC=c8621d76544a65d3ee49171a9d86377f1eed3af389d191fc0d8b1ccdf4acaf2420c84f07c944bd9de423c25c1ad514bc07f09fae7f937a590f8aa7c2a368d2b6&MSG=%7B%22Status%22%3A%22Complete%22%2C%22SurveyID%22%3A%22SV_cVn9uBwheR9hz01%22%2C%22RecipientID%22%3A%22CGC_GiMUyLkGpEZsVF3%22%2C%22ResponseEventContext%22%3A%22%22%2C%22DistributionID%22%3A%22EMD_96woxYS85Cg5Lqx%22%2C%22ResponseID%22%3A%22R_suq806jn8LGzhx7%22%2C%22CompletedDate%22%3A%222020-10-22+12%3A31%3A40%22%2C%22CreatorID%22%3A%22UR_2686s36oneK8iW1%22%2C%22DistributionChannel%22%3A%22gl%22%2C%22Duration%22%3A%222%22%2C%22Language%22%3A%22EN%22%2C%22SurveyVersionID%22%3A%229223370436078023907%22%2C%22IsPreview%22%3A%22false%22%2C%22IsTest%22%3A%22false%22%2C%22HasTextEntryAnswer%22%3A%22false%22%2C%22LinkType%22%3A%22Individual%22%2C%22BrandID%22%3A%22peopleplus%22%7D
And I try and verify the signature by signing the MSG payload and using a 32 byte array of 0s as the key for a HMACSHA512 alforithm:
string payload = [as above, either raw or as JSON]
var key = Enumerable.Repeat((byte)0, 32).ToArray();
using (HMACSHA512 hmac = new HMACSHA512(key))
{
using (MemoryStream inStream = new MemoryStream(Encoding.UTF8.GetBytes(payload)))
{
byte[] computedHash = hmac.ComputeHash(inStream);
}
}
However I cannot get the computerHash in the code above to correspond to the HMAC value in the webhook payload.
Thanks in advance for any help.
HMAC signatures for webhook subscriptions
Sign up
Already have an account? Login
Welcome! To join the Qualtrics Experience Community, log in with your existing Qualtrics credentials below.
Confirm your username, share a bit about yourself, Once your account has been approved by our admins then you're ready to explore and connect .
Free trial account? No problem. Log in with your trial credentials to join.
No free trial account? No problem! Register here
Already a member? Hi and welcome back! We're glad you're here 🙂
You will see the Qualtrics login page briefly before being taken to the Experience Community
Login with Qualtrics
Welcome! To join the Qualtrics Experience Community, log in with your existing Qualtrics credentials below.
Confirm your username, share a bit about yourself, Once your account has been approved by our admins then you're ready to explore and connect .
Free trial account? No problem. Log in with your trial credentials to join. No free trial account? No problem! Register here
Already a member? Hi and welcome back! We're glad you're here 🙂
You will see the Qualtrics login page briefly before being taken to the Experience Community
Login to the Community
Welcome! To join the Qualtrics Experience Community, log in with your existing Qualtrics credentials below.
Confirm your username, share a bit about yourself, Once your account has been approved by our admins then you're ready to explore and connect .
Free trial account? No problem. Log in with your trial credentials to join.
No free trial account? No problem! Register here
Already a member? Hi and welcome back! We're glad you're here 🙂
You will see the Qualtrics login page briefly before being taken to the Experience Community
Login with Qualtrics
Welcome! To join the Qualtrics Experience Community, log in with your existing Qualtrics credentials below.
Confirm your username, share a bit about yourself, Once your account has been approved by our admins then you're ready to explore and connect .
Free trial account? No problem. Log in with your trial credentials to join. No free trial account? No problem! Register here
Already a member? Hi and welcome back! We're glad you're here 🙂
You will see the Qualtrics login page briefly before being taken to the Experience Community
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
