Walmart.io认证问题：C#请求内认证失败，签名错误致403

Let's walk through the key issues in your code that are likely causing the 403 Forbidden error, and fix them step by step:

1. Incorrect Signature Header Name #

You're setting the signature header as WM_SEC.WM_SEC.AUTH_SIGNATURE, but Walmart.io expects the header to be WM_SEC.AUTH_SIGNATURE (the extra WM_SEC. prefix is invalid, so the server can't recognize your signature).

2. Incomplete Signature Data #

Walmart.io's signature algorithm requires more than just the consumer ID, timestamp, and key version. You're missing two critical pieces:

• The HTTP method of your request (e.g., GET)
• The full request path (not just the URL)

The correct format for the signature payload is:

HTTP_METHOD\n
REQUEST_PATH\n
WM_CONSUMER.ID\n
WM_CONSUMER.INTIMESTAMP\n
WM_SEC.KEY_VERSION\n

3. Minor Code Issues #

• You have a typo in piviateKeyVersion (should be privateKeyVersion)
• You initialized an unused RSACryptoServiceProvider variable in your signature method (it doesn't break things, but cleans up the code to remove it)

Fixed Code Example #

Main Authentication Logic

WebClient downloader = new WebClient();
string httpMethod = "GET";
string requestPath = $"/api-proxy/service/affil/product/v2/items/{id}";

// Set required headers
downloader.Headers["WM_CONSUMER.ID"] = consumerId;
long timeStamp = (long)(DateTime.UtcNow - new DateTime(1970, 1, 1)).TotalMilliseconds;
downloader.Headers["WM_CONSUMER.INTIMESTAMP"] = timeStamp.ToString();
downloader.Headers["WM_SEC.KEY_VERSION"] = privateKeyVersion; // Fixed typo

// Build the correct signature payload
string signaturePayload = $"{httpMethod}\n{requestPath}\n{downloader.Headers["WM_CONSUMER.ID"]}\n{downloader.Headers["WM_CONSUMER.INTIMESTAMP"]}\n{downloader.Headers["WM_SEC.KEY_VERSION"]}\n";

// Set the correct signature header
downloader.Headers["WM_SEC.AUTH_SIGNATURE"] = getWalmartSig(signaturePayload);

// Execute the request
string url = $"https://developer.api.walmart.com{requestPath}";
string json = downloader.DownloadString(url);

Signature Generation Method

private string getWalmartSig(string data) 
{
    AsymmetricCipherKeyPair keyPair;
    using (var reader = File.OpenText(@"key.pem")) 
    {
        // Read your PKCS1 RSA private key
        keyPair = (AsymmetricCipherKeyPair)new PemReader(reader).ReadObject();
        ISigner signer = SignerUtilities.GetSigner("SHA256WithRSA");
        signer.Init(true, keyPair.Private);
        
        byte[] payloadBytes = Encoding.UTF8.GetBytes(data);
        signer.BlockUpdate(payloadBytes, 0, payloadBytes.Length);
        byte[] signature = signer.GenerateSignature();
        
        return Convert.ToBase64String(signature);
    }
}

Additional Checks #

• Verify your server's system time is synchronized (Walmart.io rejects timestamps that are more than 5 minutes off from their server time)
• Double-check that your consumerId, privateKeyVersion, and private key file all match the values in your Walmart.io developer dashboard

内容的提问来源于stack exchange，提问作者Xiangyu Cao