HMAC SHA256 | issue in Java example

[Atifmahmood12]

https://github.com/jokecamp/jokecamp.com/commit/2d9f0734ae437b6d2d0603bc13c9f94435e1df89

Curernt example:

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Base64;

public class ApiSecurityExample {
  public static void main(String[] args) {
    try {
     String secret = "secret";
     String message = "Message";

     Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
     SecretKeySpec secret_key = new SecretKeySpec(secret.getBytes(), "HmacSHA256");
     sha256_HMAC.init(secret_key);

     String hash = Base64.encodeBase64String(sha256_HMAC.doFinal(message.getBytes()));
     System.out.println(hash);
    }
    catch (Exception e){
     System.out.println("Error");
    }
   }
}

Correction in Example:

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Base64;

public class ApiSecurityExample {
  public static void main(String[] args) {
    try {
     String secret = "secret";
     String message = "Message";

     Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
     SecretKeySpec secret_key = new SecretKeySpec(**Base64.decode**(secret.getBytes()), "HmacSHA256");
     sha256_HMAC.init(secret_key);

     String hash = Base64.encodeBase64String(sha256_HMAC.doFinal(message.getBytes()));
     System.out.println(hash);
    }
    catch (Exception e){
     System.out.println("Error");
    }
   }
}

Note: Please correct it in the documentation.

[jokecamp]

Looks like Base64.decode is the diff in the line new SecretKeySpec(**Base64.decode**(secret.getBytes()), "HmacSHA256");.

[Atifmahmood12]

Yes. That is the difference. secrete key decoding is also necessary here.

[jokecamp]

There is no need to decode the secret in these simple examples. We never expose or pass the secret so we don't need it in base64. I'm going to leave as is to keep it the same as all the other examples.

Your own implementation may vary but for these examples it is not needed.

[jokecamp]

Thanks for the feedback though. It is appreciated.

[Atifmahmood12]

OK. You welcome.