The Daily WTF

Jamie Kitson followed the instructions to integrate their software with a new payment provider. The payment API was fairly straight forward, mostly a straightforward call to a web endpoint. As an error check, the request required an base-64 encoded, MD5 hash of its contents appended to the end of it.

Jamie did just that, in C#. And the payment processor balked: the hash was wrong. There was no information beyond that, just “bad hash”.

Jamie checked the output, hashed many different possible values, confirmed that a different MD5 hashing library generated the same results, and did all of the sane things one might to do check and see if you were correctly hashing an input. They checked the documentation, confirmed that they were hashing the right contents, confirmed that there wasn’t any salting, confirmed that nothing they were doing on their end was wrong.

Eventually, Jamie tried the JavaScript sample

To read the full article click on the 'post' link at the top.