Signature Signing For Special Characters

[DanWebb]

Hi, I'm having trouble matching the signature Shopify generates for a shop with the character "®" in it's shop name.

The signature I generate is: f45ce49a4dcf227d0935a3378129bb183eb50b6c73fbce00389b7e13cbb4a155 vs. the signature Shopify generate for the same response params which is: 7b61044affc253f0485f08c44f071a37c9535f3aedf4362bd5197725f0b39ddc

Please see the full request params below, ignore the slashes this is because I've stringified the json request body.

"{\"utf8\":\"✓\",\"authenticity_token\":\"Ya5BYUm9is1JyEAjVT5ZxfAzPKxjGw0t4ft0oH1NrNBME9qwmqYF98BaGvt68236Gmd8GK1xR0RwYyoa5RvJsg==\",\"x_reference\":\"10881755009\",\"x_account_id\":\"gofreepants\",\"x_amount\":\"98.00\",\"x_currency\":\"USD\",\"x_url_callback\":\"https://checkout.shopify.com/services/ping/notify_integration/payzing/2261955\",\"x_url_complete\":\"https://checkout.shopify.com/2261955/checkouts/5cb8e76546df8d244f8a6cd01815664d/offsite_gateway_callback\",\"x_shop_country\":\"US\",\"x_shop_name\":\"Go Free® Pants\",\"x_test\":\"false\",\"x_customer_first_name\":\"Daniel\",\"x_customer_last_name\":\"Webb\",\"x_customer_email\":\"[email protected]\",\"x_customer_phone\":\"+441271344265\",\"x_customer_billing_country\":\"GB\",\"x_customer_billing_city\":\"Barnstaple\",\"x_customer_billing_company\":\"Mr.\",\"x_customer_billing_address1\":\"weirside way\",\"x_customer_billing_zip\":\"EX327RB\",\"x_customer_billing_phone\":\"+441271344265\",\"x_customer_shipping_country\":\"GB\",\"x_customer_shipping_first_name\":\"Daniel\",\"x_customer_shipping_last_name\":\"Webb\",\"x_customer_shipping_city\":\"Barnstaple\",\"x_customer_shipping_company\":\"Mr.\",\"x_customer_shipping_address1\":\"weirside way\",\"x_customer_shipping_zip\":\"EX327RB\",\"x_customer_shipping_phone\":\"+441271344265\",\"x_invoice\":\"#10881755009\",\"x_description\":\"Go Free® Pants - #10881755009\",\"x_url_cancel\":\"http://gofreepants.myshopify.com/cart\",\"x_signature\":\"7b61044affc253f0485f08c44f071a37c9535f3aedf4362bd5197725f0b39ddc\"}"

I use the node.js crypto library to generate the signature like so:

       var message = Object.keys(params).sort().map(function(key) {
            if(key!=='x_signature' && ~key.indexOf('x_')) return key+params[key];
        }).join('');

        var hmac = crypto.createHmac('SHA256', String(secret));
        hmac.setEncoding('hex');
        hmac.write(message);
        hmac.end();

        return hmac.read();

Where params is the request body and secret is the correct gateway secret for the shop. This is heavily tested and works across many shops, the same code works on this shop if ® is removed from the shops name.

I noticed the calculator https://offsite-gateway-sim.herokuapp.com/calculator is a bit outdated as it's fields are different to what Shopify POST's most notably shopify posts x_customer_shipping_first_name & x_customer_shipping_last_name but the calculator has billing first and last name fields instead of shipping so this is likely the cause of the calculator generating an entirely different result? Below is my request on the calculator the "secret_key" is there but it's cut off the bottom of the screenshot as wanted to keep it private. Note that I manually changed the billing first and last name fields to match the request from Shopify. It's given me the signature d8336dc1970dc5527cd1c9c5303ebf582c4be73c5bf8950098f08a683df9b5c1 which matches neither mine nor Shopify's.