Payment Response

Code samples to generate and verify signature hash for the data received as query parameters in redirection after payment completion.

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "net/url"
)

type PaymentResponse struct {
    OrderRef         string
    ChannelOrderRef  string
    MerchantOrderRef string
    Status           string
    SignatureHash    string
}

func VerifySignature(paymentResponse PaymentResponse, secretKey string) bool {
    // Create a url.Values map and add the necessary parameters
    params := make(url.Values)
    params.Add("order_ref", paymentResponse.OrderRef)
    params.Add("channel_order_ref", paymentResponse.ChannelOrderRef)
    params.Add("merchant_order_ref", paymentResponse.MerchantOrderRef)
    params.Add("status", paymentResponse.Status)

    // Encode the parameters
    data := params.Encode()

    // Create the HMAC hash using SHA-256
    secret := []byte(secretKey)
    message := []byte(data)
    hash := hmac.New(sha256.New, secret)
    hash.Write(message)

    // Convert the hash to a base64 string
    hashValue := base64.StdEncoding.EncodeToString(hash.Sum(nil))

    // Compare the computed hash with the signature received in the payment response
    if hashValue != paymentResponse.SignatureHash {
        fmt.Println("Hash verification failed, not from valid source")
        return false
    } else {
        fmt.Println("Hash verification succeeded")
        return true
    }
}

func main() {

    portOneSecret := "PORTONE_SECRET"

    // Define the payment response struct below with the respective query params received in redirection
    paymentResponse := PaymentResponse{
        OrderRef:         "order_ref",
        ChannelOrderRef:  "channel_order_ref",
        MerchantOrderRef: "merchant_order_ref",
        Status:           "status",
        SignatureHash:    "signature_hash",
    }

    // Verify the signature
    isValid := VerifySignature(paymentResponse, portOneSecret)

    // Output the result of the verification
    if isValid {
        fmt.Println("Payment response is valid.")
    } else {
        fmt.Println("Payment response is invalid.")
    }
}

using System;
using System.Collections.Generic;
using System.Text;
using System.Security.Cryptography;

namespace ConsoleApp
{
    class PaymentResponse
    {
        public string order_ref;
        public string merchant_order_ref;
        public string channel_order_ref;
        public string status;
        public string signature_hash;
    }

    class ApiSecurityExample
    {
        public static bool VerifySignature(PaymentResponse paymentResponse, string secret)
        {
            var map = new SortedDictionary<string, string>()
            {
                { "channel_order_ref", paymentResponse.channel_order_ref },
                { "merchant_order_ref", paymentResponse.merchant_order_ref },
                { "order_ref", paymentResponse.order_ref },
                { "status", paymentResponse.status },
            };

            var stringBuilder = new StringBuilder();
            foreach (var key in map.Keys)
            {
                if (stringBuilder.Length > 0)
                {
                    stringBuilder.Append("&");
                }
                var value = map[key];
                try
                {
                    stringBuilder.Append((key != null ? Uri.EscapeDataString(key) : ""));
                    stringBuilder.Append("=");
                    stringBuilder.Append(value != null ? Uri.EscapeDataString(value) : "");
                }
                catch (ArgumentNullException e)
                {
                    throw new Exception("The key or value is null.", e);
                }
                catch (UriFormatException e)
                {
                    throw new Exception("Invalid format for key or value.", e);
                }
            }

            var message = stringBuilder.ToString();
            // Console.WriteLine("message: " + message);
            var encoding = new ASCIIEncoding();
            byte[] keyByte = encoding.GetBytes(secret);
            byte[] messageBytes = encoding.GetBytes(message);
            var hmacsha256 = new HMACSHA256(keyByte);
            byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);
            string hash_value = Convert.ToBase64String(hashmessage);

            if (hash_value != paymentResponse.signature_hash) {
                Console.WriteLine("Hash verification failed, not from valid source");
                return false;
              } else {
                Console.WriteLine("Hash verification succeded");
                return true;
              }
        }

    }

class Program
    {
      static void Main(string[] args)
        {
            string secret = "PORTONE_SECRET";
            PaymentResponse paymentResponse = new PaymentResponse()
            {
                order_ref = "order_ref",
                merchant_order_ref = "merchant_order_ref",
                channel_order_ref = "channel_order_ref",
                status = "status",
                signature_hash = "signature_hash"
            };

            

            bool isValid = ApiSecurityExample.VerifySignature(paymentResponse, secret);

            // Print the result
            if (isValid) {
                Console.WriteLine("Payment response is valid.");
            } else {
                Console.WriteLine("Payment response is invalid.");
            }
        }
    }
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;
import java.util.Map;
import java.util.TreeMap;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

public class Main {
    public static void main(String[] args) {
        String secret = "PORTONE_SECRET";

        // Create PaymentResponse object using setter methods
        PaymentResponse paymentResponse = new PaymentResponse();
        paymentResponse.setChannelOrderRef("channelOrderRef");
        paymentResponse.setMerchantOrderRef("merchantOrderRef");
        paymentResponse.setOrderRef("orderRef");
        paymentResponse.setSignature("signature");
        paymentResponse.setStatus("status");

        boolean isValid = verifySignature(paymentResponse, secret);

        // Print the result
        if (isValid) {
            System.out.println("Payment response is valid.");
        } else {
            System.out.println("Payment response is invalid.");
        }
    }

    public static boolean verifySignature(PaymentResponse paymentResponse, String secretKey) {
        try {
            Map<String, String> params = new TreeMap<>();
            params.put("order_ref", paymentResponse.getOrderRef());
            params.put("channel_order_ref", paymentResponse.getChannelOrderRef());
            params.put("merchant_order_ref", paymentResponse.getMerchantOrderRef());
            params.put("status", paymentResponse.getStatus());

            // Encode the parameters
            String data = encodeParams(params);

            byte[] secret = secretKey.getBytes();
            byte[] message = data.getBytes();

            Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKeySpec = new SecretKeySpec(secret, "HmacSHA256");
            sha256_HMAC.init(secretKeySpec);

            byte[] hash = sha256_HMAC.doFinal(message);
            String computedSignature = Base64.getEncoder().encodeToString(hash);

            // Compare computed signature to the one received in payment response
            if (!computedSignature.equals(paymentResponse.getSignature())) {
                System.out.println("Hash verification failed, not from a valid source");
                return false;
            } else {
                System.out.println("Hash verification succeeded");
                return true;
            }
        } catch (Exception e) {
            e.printStackTrace();
            return false;
        }
    }

    public static String encodeParams(Map<String, String> params) {
        StringBuilder encodedParams = new StringBuilder();

        for (Map.Entry<String, String> entry : params.entrySet()) {
            if (encodedParams.length() > 0) {
                encodedParams.append("&");
            }
            encodedParams.append(URLEncoder.encode(entry.getKey(), StandardCharsets.UTF_8))
                         .append("=")
                         .append(URLEncoder.encode(entry.getValue(), StandardCharsets.UTF_8));
        }

        return encodedParams.toString();
    }
}

class PaymentResponse {
    private String channelOrderRef;
    private String merchantOrderRef;
    private String orderRef;
    private String signature;
    private String status;

    // Default constructor
    public PaymentResponse() {
    }

    // Setter methods
    public void setOrderRef(String orderRef) {
        this.orderRef = orderRef;
    }

    public void setChannelOrderRef(String channelOrderRef) {
        this.channelOrderRef = channelOrderRef;
    }

    public void setMerchantOrderRef(String merchantOrderRef) {
        this.merchantOrderRef = merchantOrderRef;
    }

    public void setStatus(String status) {
        this.status = status;
    }

    public void setSignature(String signature) {
        this.signature = signature;
    }

    // Getter methods
    public String getOrderRef() {
        return orderRef;
    }

    public String getChannelOrderRef() {
        return channelOrderRef;
    }

    public String getMerchantOrderRef() {
        return merchantOrderRef;
    }

    public String getStatus() {
        return status;
    }

    public String getSignature() {
        return signature;
    }
}