# Validating WebHooks in C#

**URL:** <https://discuss.dwolla.com/t/validating-webhooks-in-c/7913>\
**Category:** Other\
**Created:** [March 16, 2022, 4:01pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913 "2022-03-16T16:01:28Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![vincentbetro](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/vincentbetro/32/3424_2.png) [@vincentbetro](https://discuss.dwolla.com/u/vincentbetro)\
**Post date:** [March 16, 2022, 4:01pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/1 "2022-03-16T16:01:28Z")

</div>

So, after a little work, I was able to validate web hooks using C#. Here is the method :).

```auto
HMACSHA256 hmac = new HMACSHA256(System.Text.Encoding.UTF8.GetBytes(_dwollaOptions.WebHookSecret));

            Stream req = context.HttpContext.Request.Body;
            req.Seek(0, SeekOrigin.Begin);
            string json = new StreamReader(req).ReadToEnd();

            var validationHash = BitConverter.ToString(hmac.ComputeHash(System.Text.Encoding.UTF8.GetBytes(json))).Replace("-", "").ToLower();

            if (context.HttpContext.Request.Headers["X-Request-Signature-Sha-256"].ToString() != validationHash)
            {
                context.Result = new UnauthorizedResult();
            }

```

---

<div class="post-metadata">

**Author:** ![shreya](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/shreya/32/2154_2.png) [@shreya](https://discuss.dwolla.com/u/shreya)\
**Post date:** [March 16, 2022, 4:13pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/2 "2022-03-16T16:13:52Z")

</div>

This is very helpful!

Thank you so much for sharing, @vincentbetro! 🙂

---

<div class="post-metadata">

**Author:** ![bkristesiashvili](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/bkristesiashvili/32/3868_2.png) [@bkristesiashvili](https://discuss.dwolla.com/u/bkristesiashvili)\
**Post date:** [May 5, 2023, 6:03pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/3 "2023-05-05T18:03:10Z")

</div>

I tried this example, but it didn’t work in my case, **`request.Body`** - stream is empty on any request.  
instead of BodyStream I tried to get payload using **`context.ActionArguments.TryGetValue("payload", out var readToJson);`** it gave me the payload but **`HMACSHA256`** encrypted by Secret gives me the different hash from received from Dwolla.

---

<div class="post-metadata">

**Author:** ![bkristesiashvili](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/bkristesiashvili/32/3868_2.png) [@bkristesiashvili](https://discuss.dwolla.com/u/bkristesiashvili)\
**Post date:** [May 5, 2023, 6:13pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/4 "2023-05-05T18:13:14Z")

</div>

```auto
public bool ValidateDwollaSignature(string sha256Hash, string jsonPayload)
		{
			var secret = Encoding.ASCII.GetBytes(_dwollaOptions.WebHookHandlerOption.Secret);

			using var sha256 = new HMACSHA256(secret);
			var inBytes = Encoding.ASCII.GetBytes(jsonPayload);
			var computedHash = sha256.ComputeHash(inBytes, 0, inBytes.Length);
			var hex = BitConverter.ToString(computedHash).Replace("-", string.Empty).ToLower();

			return sha256Hash.Equals(hex);
		}

```

---

<div class="post-metadata">

**Author:** ![vincentbetro](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/vincentbetro/32/3424_2.png) [@vincentbetro](https://discuss.dwolla.com/u/vincentbetro)\
**Post date:** [May 5, 2023, 7:12pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/5 "2023-05-05T19:12:43Z")

</div>

So, you are using ASCII encoding instead of UTF8. Also, it is odd that you did not get a stream back from HttpContext.Request.Body, but as long as the json is the same, it should give the same result.

---

<div class="post-metadata">

**Author:** ![vincentbetro](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/vincentbetro/32/3424_2.png) [@vincentbetro](https://discuss.dwolla.com/u/vincentbetro)\
**Post date:** [May 5, 2023, 7:13pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/6 "2023-05-05T19:13:31Z")

</div>

@shreya was super helpful when I was working on this, so I imagine she would also be able to help you!

---

<div class="post-metadata">

**Author:** ![bkristesiashvili](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/bkristesiashvili/32/3868_2.png) [@bkristesiashvili](https://discuss.dwolla.com/u/bkristesiashvili)\
**Post date:** [May 5, 2023, 10:34pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/7 "2023-05-05T22:34:43Z")

</div>

I changed to **`UTF8`** but the result is the same, I don’t understand what I am doing wrong.

---

<div class="post-metadata">

**Author:** ![vincentbetro](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/vincentbetro/32/3424_2.png) [@vincentbetro](https://discuss.dwolla.com/u/vincentbetro)\
**Post date:** [May 8, 2023, 3:33pm UTC](https://discuss.dwolla.com/t/validating-webhooks-in-c/7913/8 "2023-05-08T15:33:32Z")

</div>

It seems that you are doing everything correctly as far as parsing and comparing, but since you are unable to get the stream information from the Request body, you may not be getting the right information to compare with. You need to figure out how to get the request body back from the web hook response.