using System;

using System.Text;

using System.Security.Cryptography;

public class Program

{

    static void Main()

    {

        Console.WriteLine(HMACValidation.HashIsValid("secret", "payload", "uC/LeRrOxXhZuYm0MKgmSIzi5Hn9+SMmvQoug3WkK6Q="));

        DocuSign();

    }

​

    public static void DocuSign(/*DocuSignWebhookRequest jsonRequest*/)

    {

        var payload = "payload";// JsonConvert.SerializeObject(jsonRequest);

        var secretKey = "secret";// ConfigurationManager.AppSettings["HMAC_Key"];

        var verifyKey = "uC/LeRrOxXhZuYm0MKgmSIzi5Hn9+SMmvQoug3WkK6Q=";// HttpContext.Current.Request.Headers["x-docusign-signature-1"];

​

        var computedHashString = ComputeHash(secretKey, payload);

        var valid = computedHashString.Equals(verifyKey); 

        Console.WriteLine(valid);

    }

​

    private static string ComputeHash(string secret, string payload)

    {

        byte[] bytes = Encoding.UTF8.GetBytes(secret);

        HMAC Mac = new HMACSHA256(bytes);

        bytes = Encoding.UTF8.GetBytes(payload);

        return Convert.ToBase64String(Mac.ComputeHash(bytes));

    }

}

​

public static class HMACValidation

{

    public static string ComputeHash(string secret, string payload)

    {

        byte[] bytes = Encoding.UTF8.GetBytes(secret);

        HMAC hmac = new HMACSHA256(bytes);

        bytes = Encoding.UTF8.GetBytes(payload);

​

        return Convert.ToBase64String(hmac.ComputeHash(bytes));

    }

​

    public static bool HashIsValid(string secret, string payload, string verify)

    {

        ReadOnlySpan<byte> hashBytes = Convert.FromBase64String(ComputeHash(secret, payload));

        ReadOnlySpan<byte> verifyBytes = Convert.FromBase64String(verify);

​

        return CryptographicOperations.FixedTimeEquals(hashBytes, verifyBytes);

    }

}

​