[PHP] X-Fitbit-Signature not matching when testing against example in documentation

[sparkwatson]

I'm looking to add a validation check for X-Fitbit-Signature and I'm following along the example given here but when I made a test script to see if it works, it does not and I'm not sure why that is.

I'm fairly certain I'm doing it right, and I've played around with the example payload a few times but nothing I do will make the example given match for me.

Is the example wrong or does the json has to bwe a certain format that I haven't tried? (I've made it all one line and that didn't work either).

I don't feel comfortable adding the header check until I can verify myself that it'll work, so hoping someone can point me to where I may be going wrong or if the documentation is missing an important step.

Thanks.

[sparkwatson]

This is my PHP script:

<?php
$payload = '[omitted due to forum validation]';

$clientSecret = '123ab4567c890d123e4567f8abcdef9a&';
$checksum = base64_encode(hash_hmac('sha1', $payload, $clientSecret, true));
$expectedValue = 'Oyv+HBziS4dH/fHJ735cToXX6vs=';

if ($checksum === $expectedValue) {
    echo "Checksum Verified.\n";
} else {
    echo "Checksum Failed.\n\n";
    echo "DEBUGGING:\n";
    echo "VALUE:\t\t".$checksum."\n";
    echo "EXPECTED VALUE:\t".$expectedValue."\n";
}

This is what I get back:

Checksum Failed.

DEBUGGING:
VALUE: DWL9bvdGZ4rQwePgCYEgI3xEFoo=
EXPECTED VALUE: Oyv+HBziS4dH/fHJ735cToXX6vs=

[GordonFitbit]

Hi @sparkwatson 

I'm not familiar with PHP however, the samples I found online seems to mimic what you are doing.   For $payload, are you specifying the entire notification including the array?

[
  {
    "collectionType": "foods",
    "date": "2020-06-01",
    "ownerId": "228S74",
    "ownerType": "user",
    "subscriptionId": "1234"
  }
]

[sparkwatson]

Am I not supposed to? I assumed the signature is the  body plus the secret.

[GordonFitbit]

You are.  The signature includes the body and secret.   Let me see if I can put together a PHP example for you.   

Gordon

[sparkwatson]

That'd be great, I feel like I have the code portion right, I may just be assuming the payload portion incorrectly.

[sparkwatson · Accepted solution]

I decided to just roll the dice and test it on our staging environment and it appears to be working correctly, Fitbit was able to hit the endpoint and the validation passed so while I couldn't make a reproducible example for myself, I was able to confirm it's working and that's good enough for me. 😀

[GordonFitbit]

Hi @sparkwatson,

Thank you for the update.   Out of curiosity, did you use the same code as above which the value generated and the expected value do not match?

[sparkwatson]

basically, yes, I used the same code as provided here. I'm guessing the disconnect is just how the example request body is parsed. While I'd like to have a reproducible test, it's not the end of the world if it seems to work when used in the wild, the important part is it works when Fitbit send my API data and it does so I'll take that as a win and settle for it.

[GordonFitbit]

Great!!   Glad to hear.