title: HMAC and SHA256 - how to validate using nonce
body: <p>Im trying to integrate with a Web API. Looking at how they use SHA256 and HMAC to generate their signature.  However they also use whats known as an "nonce", which I had to look up.  This api generates the "signature" using a secret that both of us know, combined with the url of the request.</p>
  
  <p>So, do I use the same nonce they are using to generate a signature on my end to do the validation with?</p>
  
  <p>Im looking at a sample of how they are generating their signature like this on the client end.</p>
  
  <pre><code>        var message = "https://my.server.com/new-callback?reqID=test&amp;nonce=8cf95201-4d3c-4397-9117-d7ee6ad89d93";
          var secret = "g394g732vhsdfiv34";
          var hash = CryptoJS.HmacSHA256(message, secret);
          var signature = hash.toString(CryptoJS.enc.Base64); 
  
  result of signature...
  </code></pre>
  
  <p><br/>
      // ihyCCfTHog7TDQYT4tQM5ISYSjEIaChSeJmIo3UMa+U= <br/></p>
  
  <p>However, I dont get the same result using this tool <br/>
  <a href="http://www.freeformatter.com/hmac-generator.html" rel="nofollow noreferrer">http://www.freeformatter.com/hmac-generator.html</a></p>
  
  <p>So to validate this on my end (within the api), I need to use the same inputs to compute the signature and then simply compare the resulting strings, correct?  </p>
  
  <p>What purpose does this "nonce" component serve?  From what Ive read, it more or less serves the same purpose as a GUID.</p>
  
  <p>What am I missing?</p>