How to sign and verify a message with HMAC-SHA256 in C# (.NET)

1using System.Security.Cryptography;
2 
3static class Webhook
4{
5    // Sender: HMAC-SHA256 over the exact body bytes, sent as "sha256=<hex>"
6    public static string Sign(byte[] secret, byte[] rawBody) =>
7        "sha256=" + Convert.ToHexStringLower(HMACSHA256.HashData(secret, rawBody));
8 
9    // Receiver: recompute over the raw body and compare in constant time
10    public static bool Verify(byte[] secret, byte[] rawBody, string? header)
11    {
12        if (header is null || !header.StartsWith("sha256=", StringComparison.Ordinal)) return false;
13        byte[] received;
14        try
15        {
16            received = Convert.FromHexString(header.AsSpan(7)); // upper- or lower-case hex
17        }
18        catch (FormatException)
19        {
20            return false;
21        }
22        return CryptographicOperations.FixedTimeEquals(received, HMACSHA256.HashData(secret, rawBody));
23    }
24}
25 

1using System.Text;
2using System.Text.Json;
3 
4var app = WebApplication.CreateBuilder(args).Build();
5byte[] secret = Encoding.UTF8.GetBytes(app.Configuration["WEBHOOK_SECRET"]
6    ?? throw new InvalidOperationException("WEBHOOK_SECRET is not set"));
7 
8app.MapPost("/webhook", async (HttpRequest request) =>
9{
10    using var buffer = new MemoryStream();
11    await request.Body.CopyToAsync(buffer); // the bytes as received, before any model binding
12    byte[] rawBody = buffer.ToArray();
13    if (!Webhook.Verify(secret, rawBody, request.Headers["X-Hub-Signature-256"]))
14    {
15        return Results.Text("bad signature\n", statusCode: StatusCodes.Status401Unauthorized);
16    }
17    JsonElement e = JsonSerializer.Deserialize<JsonElement>(rawBody);
18    return Results.Text($"accepted {e.GetProperty("action")} #{e.GetProperty("number")}\n");
19});
20 
21app.Run();
22