title: Golang - Dropbox webhook signature validation hmac
body: <p>I am writing a program that needs to use Dropbox's webhooks. I haven't been able to find any Go implementation already in place, so I've decided to write mine. Unfortunately, it doesn't seem to work. </p>
  
  <p>I think the issue here is with <strong>hmac</strong>, as I am most probably doing something wrong, but I just can't seem to understand where exactly the issue here. Any idea?</p>
  
  <p>The following is what I have:</p>
  
  <pre><code>package dboxwebhook
  
  import (
      "bytes"
      "crypto/hmac"
      "crypto/sha256"
      "errors"
      "io"
      "io/ioutil"
      "log"
  )
  
  type Signature struct {
      AppSecret []byte
      Signature []byte
  }
  
  func (w *Signature) Check(reqBody io.ReadCloser) error {
  
      if bytes.Compare(w.Signature, nil) == 0 {
          return errors.New("DropBox signature doesnt exist")
      }
  
      // building HMAC key (https://golang.org/pkg/crypto/hmac/)
      mac := hmac.New(sha256.New, w.AppSecret)
      requestBody, err := ioutil.ReadAll(reqBody)
      if err != nil {
          return err
      }
  
      mac.Write(requestBody)
      expectedMac := mac.Sum(nil)
  
      log.Println(w.AppSecret)
      log.Println(expectedMac)
      log.Println(w.Signature)
  
      // compare if it corresponds with the signature sent by DropBox
      comparison := hmac.Equal(w.Signature, expectedMac)
  
      if !comparison {
          return errors.New("Signature Check unsuccessful")
      }
  
      return nil
  
  }
  </code></pre>
  
  <p>To test this, the only way I know is to use <a href="https://github.com/dropbox/dropbox_hook" rel="nofollow">this Python script</a> from Dropbox.</p>