C# HMAC验证失败，代码403

过去三天我一直在探索Payezy api。我只是从一个C应用程序发出一个简单的http web请求。我已经遵循了所有提到的步骤，并正确地验证了每一步。以下是每个项目的详细信息

API密钥：-我已验证我的API密钥是否正确。 API机密：-它也是正确的。 商户代币：-也经过验证。 Nonce:-我创建了如下加密强随机数

RandomNumberGenerator rng = new RNGCryptoServiceProvider();
byte[] nonceData = new byte[18];
rng.GetBytes(nonceData);
string nonce = BitConverter.ToUInt64(nonceData,0).ToString();  

private string CreateAuthorization(string data, string secret)
{
    // data is in following format.
    //  data = apiKey + nonce + timestamp + token + payload;
    secret = secret ?? "";
    using (var hmacsha256 = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
    {
        byte[] hashdata = hmacsha256.ComputeHash(Encoding.UTF32.GetBytes(data));
        return Convert.ToBase64String(hashdata);
    }
}

时间戳：-

string timestamp = Convert.ToInt64(ts.TotalMilliseconds).ToString();

有效载荷：-

{"merchant_ref":"Astonishing-Sale","transaction_type":"authorize","method":"credit_card","amount":"1299","currency_code":"USD","credit_card":{"type":"visa","cardholder_name":"John Smith","card_number":"4788250000028291","exp_date":"1020","cvv":"123"}}

然后我创建了HMAC，如下所示

RandomNumberGenerator rng = new RNGCryptoServiceProvider();
byte[] nonceData = new byte[18];
rng.GetBytes(nonceData);
string nonce = BitConverter.ToUInt64(nonceData,0).ToString();  

private string CreateAuthorization(string data, string secret)
{
    // data is in following format.
    //  data = apiKey + nonce + timestamp + token + payload;
    secret = secret ?? "";
    using (var hmacsha256 = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
    {
        byte[] hashdata = hmacsha256.ComputeHash(Encoding.UTF32.GetBytes(data));
        return Convert.ToBase64String(hashdata);
    }
}

现在我得到了hmac验证错误。我生成的hmac字符串是64位的，而在您的网站上的docs和sandbox下是86位的。 你能在这方面帮助我吗，因为我在过去三天里一直在这个问题上纠缠不清。

---

谢谢这些是“HMAC验证失败”的常见原因：

API密钥和/或API机密不正确。 API密钥、API机密、商户令牌中的前导或尾随空格。 HTTP标头中的时间戳不是以毫秒为单位的。 HTTP标头中的时间戳不表示历元时间。 HTTP头中的时间戳不在服务器时间的5分钟内。 系统时间不准确。 下面是生成HMAC的示例c代码：

public byte[] CalculateHMAC(string data, string secret)
    {
        HMAC hmacSha256 = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
        byte[] dataBytes = Encoding.UTF8.GetBytes(data);
        byte[] hmac2Hex = hmacSha256.ComputeHash(Encoding.UTF8.GetBytes(data));

        string hex = BitConverter.ToString(hmac2Hex);
        hex = hex.Replace("-","").ToLower();
        byte[] hexArray = Encoding.UTF8.GetBytes(hex);
        return hexArray;
    }

protected void Button1_Click(object sender, EventArgs e)
{                     
    string jsonString = "{ \"merchant_ref\": \"MVC Test\", \"transaction_type\": \"authorize\", \"method\": \"credit_card\", \"amount\": \"1299\", \"currency_code\": \"USD\", \"credit_card\": { \"type\": \"visa\", \"cardholder_name\": \"Test Name\", \"card_number\": \"4005519200000004\", \"exp_date\": \"1020\", \"cvv\": \"123\" } }";

    Random random = new Random();
    string nonce = (random.Next(0, 1000000)).ToString();

    DateTime date = DateTime.UtcNow;
    DateTime epoch = new DateTime(1970, 1, 1, 0, 0, 0, 0);
    TimeSpan span = (date - epoch);
    string time = span.TotalSeconds.ToString();

    string token = Request.Form["token"];//Merchant token
    string apiKey = Request.Form["apikey"];//apikey
    string apiSecret = Request.Form["apisecret"];//API secret
    string hashData = apiKey+nonce+time+token+jsonString;

    string base64Hash = Convert.ToBase64String(CalculateHMAC(hashData, apiSecret));

    string url = "https://api-cert.payeezy.com/v1/transactions";

    //begin HttpWebRequest
    HttpWebRequest webRequest = (HttpWebRequest)WebRequest.Create(url);

    webRequest.Method = "POST";
    webRequest.Accept = "*/*";
    webRequest.Headers.Add("timestamp", time);
    webRequest.Headers.Add("nonce", nonce);
    webRequest.Headers.Add("token", token);
    webRequest.Headers.Add("apikey", apiKey);
    webRequest.Headers.Add("Authorization", base64Hash );
    webRequest.ContentLength = jsonString.Length;
    webRequest.ContentType = "application/json";

    StreamWriter writer = null;
    writer = new StreamWriter(webRequest.GetRequestStream());
    writer.Write(jsonString);
    writer.Close();

    string responseString;
    try
        {
            using(HttpWebResponse webResponse = (HttpWebResponse)webRequest.GetResponse())
            {
                using (StreamReader responseStream = new StreamReader(webResponse.GetResponseStream()))
                {
                    responseString = responseStream.ReadToEnd();
                    request_label.Text = "<h3>Request</h3><br />" + webRequest.Headers.ToString() + System.Web.HttpUtility.HtmlEncode(jsonString);
                    response_label.Text = "<h3>Response</h3><br />" + webResponse.Headers.ToString() + System.Web.HttpUtility.HtmlEncode(responseString);
                }
            }
        }
    catch (WebException ex)
    {
        if (ex.Response != null) 
        {
            using (HttpWebResponse errorResponse = (HttpWebResponse)ex.Response) 
            {
                using (StreamReader reader = new StreamReader(errorResponse.GetResponseStream())) 
                {
                    string remoteEx = reader.ReadToEnd();
                    error.Text = remoteEx;
                }
            }
        }           
    }
}

---

我一直在做一个集成，它工作得很好；也许你可以看一眼

具体来说，您需要查看以下内容：

---

祝您好运：

我复制了您的代码，只输入了token、apiKey和apiSecret的值，但仍然收到HMAC验证错误：我比较了Payezy网站和我生成的网站的总毫秒数。以下是总数。1 Payezy:1439268787215 2 Mine:1439268783429微小差异是由于从VS和Payezy网站复制过程中经过的时间。