Search code examples
phpcoldfusionlucee

Hashing the value to the api

I had this code 

  $params = $version.$merchant_id.$payment_description.$order_id.$currency.$amount.$result_url_1;
    $hash_value = hash_hmac('sha256',$params, $secret_key,false);

converted to CF as 

     param = version & merchant_id & payment_description & order_id & currency & amount & result_url_1,"SHA-256")>
hash_value = lcase(hash(param & secret_key,"SHA-256')>

But data is different , am i missing anything

Solution

  • The php code (first code snippet) is using hash_hmac, which requires a shared key to produce the hash, as the code shows. Your CF code (second code snippet) only uses a normal hash function.

    You cannot simply concatenate the param and secret like you do. It will not result in the same hash as your php code. You need to use the HMac function of CF, and use it in the same way as the php code, keeping the secret as a separate parameter to the hmac function.

    See reference: https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-functions/functions-h-im/hmac.html

    As stated by the user, the CF HMac function returns a hash in UPPERcase, while the PHP hash_mac function returns the hash in lowercase. To be able to compare the 2 as strings, convert the CF HMac to lowercase by wrapping it in a LCase function.