如何在Python中验证HMAC摘要？签名匹配失败求助

我卡在HMAC数据摘要验证上已经好几天了，Python代码始终生成不出匹配预期的签名。

测试代码 #

import hmac
import hashlib
import json

# 模拟接收的Webhook payload
payload = {
        "applicantId" : "64899a9e52e16960a43a2d8c",
        "inspectionId" : "64899a9e52e16960a43a2d8d",
        "applicantType" : "individual",
        "correlationId" : "9e732c5f814e27b766d20a85d23d169c",
        "levelName" : "basic-kyc-level",
        "sandboxMode" : True,
        "externalUserId" : "uOev8DYqbH",
        "type" : "applicantCreated",
        "reviewStatus" : "init",
        "createdAt" : "2024-04-17 06:57:33+0000",
        "createdAtMs" : "2024-04-17 06:57:33.165",
        "clientId" : "uab_first_digital_trade_europe"
        }

plain_text_payload = ','.join(f"{k}:{str(v).lower()}" if isinstance(v, bool) else f"{k}:{v}" for k, v in payload.items())

encoded_payload = plain_text_payload.encode('utf-8')

secret_key = 'TZUQlLdW-E5VM7nbcByTbyQx9G_'
encoded_secret = secret_key.encode('utf-8')
    
computed_signature = hmac.new(encoded_secret, encoded_payload, hashlib.sha256).hexdigest()

print("Computed HMAC signature:", computed_signature)

# 预期的签名
signature = "84ea2fd80f8972554a2f7c1d7e97823abff09a32bd9af3865251f696fe0f31af"


if computed_signature == signature:
    print("Signatures match.")
else:
    print("Signatures do not match.")

目前这段代码无法匹配预期签名，我尝试过调整布尔值"true"的大小写、给布尔值加引号，都没有成功。但通过在线HMAC工具可以得到预期的签名。

尝试的验证函数1：直接处理JSON payload #

def validate_webhook():
    # 映射算法到对应的哈希函数
    algo_map = {
        'HMAC_SHA1_HEX': hashlib.sha1,
        'HMAC_SHA256_HEX': hashlib.sha256,
        'HMAC_SHA512_HEX': hashlib.sha512,
    }

    # 从请求头获取算法
    algo_name = request.headers.get('X-Payload-Digest-Alg')
    if algo_name not in algo_map:
        log_message(f"Unsupported algorithm: {algo_name}", "ALERT", run_id=g.run_id)
        raise RuntimeError('Unsupported algorithm')

    # 获取对应的哈希函数
    hash_func = algo_map[algo_name]

    secret_key = 'TZUQlLdW-E5VM7nbcByTbyQx9G_'

    # 计算内容的HMAC
    content = request.get_data()  # 获取原始二进制数据
    computed_signature = hmac.new(secret_key.encode(), content, hash_func).hexdigest()

    # 获取请求头中的签名
    signature = request.headers.get('X-Signature')

    # 验证签名是否匹配
    if computed_signature != signature:
        log_message(f"Webhook sumsub sign {content}", "ALERT", run_id=g.run_id)
        raise Exception('Webhook sumsub sign validation failed')

    # 签名验证通过，后续处理
    log_message(content.decode('utf-8'), "INFO", run_id=g.run_id, data=content.decode('utf-8') )
    return True

尝试的验证函数2：转为文本后处理 #

def validate_webhook():
    # 映射算法到对应的哈希函数
    algo_map = {
        'HMAC_SHA1_HEX': hashlib.sha1,
        'HMAC_SHA256_HEX': hashlib.sha256,
        'HMAC_SHA512_HEX': hashlib.sha512,
    }

    # 从请求头获取算法
    algo_name = request.headers.get('X-Payload-Digest-Alg')
    if algo_name not in algo_map:
        log_message(f"Unsupported algorithm: {algo_name}", "ALERT", run_id=g.run_id)
        raise RuntimeError('Unsupported algorithm')

    # 获取对应的哈希函数
    hash_func = algo_map[algo_name]

    secret_key = 'TZUQlLdW-E5VM7nbcByTbyQx9G_'

    # 计算内容的HMAC
    content = request.get_data(as_text=True)  # 获取文本格式的数据
    # 显式编码为UTF-8后计算HMAC
    encoded_content = content.encode('utf-8')
    computed_signature = hmac.new(secret_key.encode(), encoded_content, hash_func).hexdigest()

    # 获取请求头中的签名
    signature = request.headers.get('X-Signature')

    # 验证签名是否匹配
    if computed_signature != signature:
        log_message(f"Webhook sumsub sign {content}", "ALERT", run_id=g.run_id)
        raise Exception('Webhook sumsub sign validation failed')

    # 签名验证通过，后续处理
    log_message(content, "INFO", run_id=g.run_id, data=content )
    return True

实际接收的payload #

b'{
  "applicantId" : "6616c4f80cc65e2a1fe1419d",
  "inspectionId" : "6616c4f80cc65e2a1fe1419e",
  "applicantType" : "individual",
  "correlationId" : "7a3450416467276914de43eb75b5916a",
  "sandboxMode" : true,
  "externalUserId" : "level-2ce713de-679a-453e-9719-2464082633c5",
  "type" : "applicantCreated",
  "reviewStatus" : "init",
  "createdAt" : "2024-04-17 08:28:07+0000",
  "createdAtMs" : "2024-04-17 08:28:07.745",
  "clientId" : "uab_first_digital_trade_europe"
}'

内容的提问来源于stack exchange，提问作者Luke_V