IPN code samples

PERL version

use strict;
use CGI;
use Digest::SHA qw(hmac_sha256_hex);

# modify your settings here

# pass to compute HASH. Retrieve your secret key by accessing https://secure.2checkout.com/cpanel/webhooks_api.php
my $myKey='AABBCCDDEEFF';

# / end modifications area

my $q = new CGI;
my @name = $q->param;
print "Content-type: text/html\n\n";
my $in_sha256='';
my $first_product = '';
my $first_pid = '';

# Main loop
foreach my $par (@name) {
  next if ($par=~/HASH|SIGNATURE_SHA2_256|SIGNATURE_SHA3_256/i);
      if ($q->param($par) ne '') { #parameter not empty
        my @myList = $q->param($par);
          if (scalar(@myList)) { #multi valued
            foreach my $el (@myList) {
              $in_sha256.=length($el).$el;
          if ($par eq "IPN_PNAME[]") { $first_product = $myList[0]; }
          if ($par eq "IPN_PID[]") { $first_pid = $myList[0]; }
            }
          } else { #single valued
            $in_sha256.=length($q->param($par)).$q->param($par);
          }
      } else { #empty parameter
        $in_sha256.='0';
      }
}

my $mySha = $q->param('SIGNATURE_SHA2_256');
my $shaVerify = hmac_sha256_hex($in_sha256, $myKey);
my $response='';
if ($mySha=~/^$shaVerify$/i) { # ok
    # The notification is genuine / verified
    # Write your own code here to insert the data into a database or email it in a specified format
    # The code below will confirm the request
  $response = length($first_pid).$first_pid.length($first_product).$first_product.length($q->param("IPN_DATE")).$q->param("IPN_DATE");
  my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = gmtime(time);
  my $now = (1900+$year).sprintf("%02d", $mon+1).sprintf("%02d", $mday).sprintf("%02d", $hour).sprintf("%02d", $min).sprintf("%02d", $sec);
  $response.=length($now).$now;
  my $shaResponse = hmac_sha256_hex($response, $myKey);
  print '<sig algo="sha256" date="' . $now . '">' . $shaResponse . '</sig>';
  print "\n";
} else { # not ok
  print '<EPAYMENT>Error. Cannot verify signature.</EPAYMENT>';
  print "\n";
}

C#

using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;

namespace VerifoneIPNSample
{
    public class IpnSignatureHandler
    {
        public string calculateSignature(
            IEnumerable<KeyValuePair<string, string>> requestPayloadValues,
            string secretKey,
            string currentDate
            )
        {
            int size = 0;
            string hash = string.Empty;
            UTF8Encoding encoding = new UTF8Encoding();
            System.Text.StringBuilder PlainDataToHash = new System.Text.StringBuilder();
            var res = requestPayloadValues.GetEnumerator();

            while (res.MoveNext())
            {
                switch (res.Current.Key)
                {
                    case "IPN_PID[]":
                        size = res.Current.Value.Length;

                        PlainDataToHash.Append(size);
                        PlainDataToHash.Append(res.Current.Value);
                        break;
                    case "IPN_PNAME[]":
                        size = res.Current.Value.Length;

                        PlainDataToHash.Append(size);
                        PlainDataToHash.Append(res.Current.Value);
                        break;
                    case "IPN_DATE":
                        size = res.Current.Value.Length;

                        PlainDataToHash.Append(size);
                        PlainDataToHash.Append(res.Current.Value);
                        break;
                }
            }
            size = currentDate.Length;
            PlainDataToHash.Append(size);
            PlainDataToHash.Append(currentDate);

            Console.WriteLine(PlainDataToHash);

            string pass = secretKey;
            byte[] passBytes = encoding.GetBytes(pass);

            // sha256; for sha3-256, replace HMACSHA256 with HMACSHA3_256
            HMACSHA256 hmacSha = new HMACSHA256(passBytes);
            string HashData = PlainDataToHash.ToString();

            byte[] baseStringForHashBytes = encoding.GetBytes(HashData);
            byte[] hashBytes = hmacSha.ComputeHash(baseStringForHashBytes);

            hash = ByteToString(hashBytes);

            return hash;
        }

        private static string ByteToString(byte[] buff)
        {
            string sbinary = "";
            for (int i = 0; i < buff.Length; i++)
            {
                sbinary += buff[i].ToString("x2"); // hex format
            }
            return (sbinary);
        }

        public string generateTag(
            IEnumerable<KeyValuePair<string, string>> requestPayloadValues,
            string secretKey
            )
        {
            var now = DateTime.Now.ToString("yyyyMMddHHmmss");
            var responseHash = calculateSignature(requestPayloadValues, secretKey, now);

            // sha256; for sha3-256, replace algo=\"sha256\" with algo=\"sha3-256\"
             return $"<sig algo=\"sha256\" date=\"{now}\">{responseHash}</sig>";
        }
    }
}

C# - IPN Signature Handler Test Example

using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;
using Microsoft.VisualStudio.TestTools.UnitTesting;

namespace VerifoneIPNSample.Tests
{
    [TestClass()]
    public class IpnSignatureHandlerTests
    {
        [TestMethod()]
        public void TestCalculateSignature() {
            List<KeyValuePair<string, string>> requestPayloadValues = new List<KeyValuePair<string, string>>()
            {
                new KeyValuePair<string, string>("IPN_PID[]", "1"),
                new KeyValuePair<string, string>("IPN_PNAME[]", "Software program"),
                new KeyValuePair<string, string>("IPN_DATE", "20050303123434"),
            };

            string testedDate = "20050303123434";
            string secretKey = "test";

            IpnSignatureHandler ipnHandler = new IpnSignatureHandler();

            var responseHash = ipnHandler.calculateSignature(requestPayloadValues, secretKey, testedDate);

            Console.WriteLine(responseHash);

            // sha256; for sha3-256, compare with "2726fe88a5b2bf7907034053124964eb614b46b929acc804034f7071121a4efb"
            Assert.AreEqual(responseHash, "7efee0c4b7b129f9b96ab279366c1ded92578d947596fb639060d1796ac431b3");
        }
    }
}

Related documentation

• Instant Payment Notification (IPN)

• IPN POST failure recovery process

• IPN parameters