0

I am using Power Platform Cloud Flows (similar to Logic Apps) to receive messages from WhatsApp through webhooks. I have created a "When an HTTP Request is received" trigger.

We are trying to validate the payload using the code below. The issue we are facing is that when the message type is "text", we are able to generate a valid signature. However, when the type is "media" (image, etc.), the generated signature is not valid compared to the one we received from WhatsApp.

I am calling my custom action to use the below code.

Any ideas on how to resolve this?

  public static string CalculateSignature(string appSecret, string payload)
  {
      /*
       Please note that the calculation is made on the escaped unicode version of the payload, with lower case hex digits.
       If you just calculate against the decoded bytes, you will end up with a different signature.
       For example, the string äöå should be escaped to \u00e4\u00f6\u00e5.
       */

      using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(appSecret)))
      {
          hmac.Initialize();
          byte[] hashArray = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
          var ss = BitConverter.ToString(hashArray);
          return BitConverter.ToString(hashArray).Replace("-", string.Empty).ToLower();
      }
  }

enter image description here

enter image description here

We have attempted other samples, but no success. I would appreciate any helpful solutions.

4
  • What is this? Can you clearly provide the full code that you are using and Logic app deisgn too and output which worked too. Commented Jul 8 at 10:21
  • I tried to give more details. @RithwikBojja
    – V.M
    Commented Jul 8 at 14:09
  • Try to use this string x = JsonConvert.SerializeObject(payload).Trim('"'); before using statement and use x in place of payload and try Commented Jul 10 at 3:09
  • Unfortunately, it didn't help. If there are special characters (ö,ä etc) in the message content, unfortunately, the code does not match. I found something, could it be that the decoding is wrong because it automatically converts the payload to JSON when the HTTP trigger message arrives? Please note that we generate the signature using an escaped unicode version of the payload, with lowercase hex digits. If you just calculate against the decoded bytes, you will end up with a different signature. For example, the string äöå should be escaped to \u00e4\u00f6\u00e5.
    – V.M
    Commented Jul 10 at 7:33

0