Authenticate a provider-signed payload before decoding or applying its instructions. The examples separate the essential operation from the conditions a production implementation must enforce.
What It Does
Authenticate a provider-signed payload before decoding or applying its instructions.
Prerequisites
Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.
Example 1: Core Behavior
This scenario applies the exact rule described in the guide, with controlled sample values.
<?php
$raw=json_encode(["id"=>12], JSON_THROW_ON_ERROR); $key="test-key"; $sent=hash_hmac("sha256",$raw,$key);
echo hash_equals($sent,hash_hmac("sha256",$raw,$key))?"Verified":"Rejected";Example 2: Alternative or Failure Case
This scenario applies the exact rule described in the guide, with controlled sample values.
<?php
$key="test-key"; $body="raw message"; $sent=base64_encode(hash_hmac("sha256",$body,$key,true));
$expected=base64_encode(hash_hmac("sha256",$body,$key,true)); echo hash_equals($expected,$sent)?"Valid":"Invalid";Practical Example: Applying the Rule
This scenario applies the exact rule described in the guide, with controlled sample values.
<?php
$header="sha256=bad"; $value=substr($header,7);
echo preg_match("/^[a-f0-9]{64}$/D",$value)?"Check digest":"Reject malformed header";Important Behavior and Edge Cases
Do not serialize a parsed JSON object for verification because its bytes can change.
Comparison with Related Functions or Patterns
| Approach | When it differs |
|---|---|
| Verifying Webhook Signatures in PHP | Authenticate a provider-signed payload before decoding or applying its instructions. |
| Related API or pattern | A timestamp or event ID enables separate replay detection. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Verifying re-serialized JSON instead of the original payload bytes | Do not serialize a parsed JSON object for verification because its bytes can change. |
| Substituting a related API without checking its semantics | A timestamp or event ID enables separate replay detection. |
Key Takeaways
- Authenticate a provider-signed payload before decoding or applying its instructions.
- Do not serialize a parsed JSON object for verification because its bytes can change.
- A timestamp or event ID enables separate replay detection.
Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.