Data Integrity

signedPayload = bytes(X-Timestamp) + bytes(".") + rawBodyBytes

POST /GetCreateAccountUrl HTTP/1.1
Host: partner.example.com
Content-Type: application/json
X-Timestamp: 2026-01-15T18:42:07.123Z
X-Signature: Zk3mQpX9vLc7RtN2wJh8bD1sF6aG0uYeK4rTq5Xz...

{"transactionId":"5c9e6c3a-8b1a-5e2f-9a1b-0d4e6f2c7a10","subscriberId":"SUB-000123", ... }

using System.Security.Cryptography;
using System.Text;

public sealed class SignatureVerificationMiddleware
{
    private readonly RequestDelegate _next;
    private readonly string _secret; // provisioned per-Partner, from secure config

    public SignatureVerificationMiddleware(RequestDelegate next, string secret)
    {
        _next = next;
        _secret = secret;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // 1. Read the RAW body without consuming it for downstream handlers.
        context.Request.EnableBuffering();

        byte[] rawBody;
        using (var ms = new MemoryStream())
        {
            await context.Request.Body.CopyToAsync(ms);
            rawBody = ms.ToArray();
            context.Request.Body.Position = 0; // rewind for model binding
        }

        // 2. Read the headers.
        var timestamp = context.Request.Headers["X-Timestamp"].ToString();
        var provided = context.Request.Headers["X-Signature"].ToString();
        if (string.IsNullOrEmpty(timestamp) || string.IsNullOrEmpty(provided))
        {
            await Reject(context, "Missing X-Timestamp or X-Signature header");
            return;
        }

        // 3. Build the signed payload: timestamp + "." + raw body.
        byte[] signedPayload = Encoding.UTF8.GetBytes(timestamp)
            .Concat(Encoding.UTF8.GetBytes("."))
            .Concat(rawBody)
            .ToArray();

        // 4. Recompute HMAC-SHA256 over the signed payload.
        using var hmac = new HMACSHA256(Encoding.ASCII.GetBytes(_secret));
        byte[] computedHash = hmac.ComputeHash(signedPayload);
        string computed = Convert.ToBase64String(computedHash);

        // 5. Constant-time comparison (avoids timing side channels).
        bool valid = CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(computed),
            Encoding.UTF8.GetBytes(provided));

        // 6. Decide.
        if (!valid)
        {
            await Reject(context, "Invalid signature");
            return;
        }

        await _next(context);
    }

    private static async Task Reject(HttpContext ctx, string reason)
    {
        ctx.Response.StatusCode = StatusCodes.Status401Unauthorized;
        await ctx.Response.WriteAsync($"{{\"error\":\"{reason}\"}}");
    }
}

// Registration (Program.cs):
// app.UseMiddleware<SignatureVerificationMiddleware>(builder.Configuration["Platform:SharedSecret"]);

TS='2026-01-15T18:42:07.123Z'
BODY='{"transactionId":"5c9e6c3a-8b1a-5e2f-9a1b-0d4e6f2c7a10","subscriberId":"SUB-000123","amount":150.75,"currency":"PEN","reference":"OP-2026-778812"}'
printf '%s.%s' "$TS" "$BODY" \
  | openssl dgst -sha256 -hmac 'wh_secret_9f2a7c1e4b8d0a6f3e5c2b1d8a4f7e0c' -binary \
  | base64
# => nQdLCID8zS6tVNG6+Exu5nPiYA8IEAakeo8qVbocKOk=