Csharp 使用ASP.NET MVC for Lemon Squeezy XSignature创建散列

The bug in the posted code was that the C# code only calculated the SHA256 value instead of the HMAC/SHA56 value.
After fixing this, the key was not specified correctly and the Create() method was applied, which requires the specification of the digest, which was missing.

确定HMAC/SHA256可以在.NET上实现，如下所示，使用HMASCSHA256:

using System;
using System.Security.Cryptography;
using System.Text;
...
byte[] secret = Encoding.UTF8.GetBytes("some secret");
byte[] payload = Encoding.UTF8.GetBytes("some payload");
using (var hmacSha256 = new HMACSHA256(secret)) 
{
    byte[] hash = hmacSha256.ComputeHash(payload);
    Console.WriteLine(Convert.ToHexString(hash)); // 22A2E09F97E933DB48BA6EF24C6BE11A5A10024BD9A6A18E662E94BF3C35F257
}

当然，密钥也可以在以后设置:

...
using (var hmacSha256 = new HMACSHA256()) 
{
    hmacSha256.Key = secret;
    byte[] hash = hmacSha256.ComputeHash(payload);
    Console.WriteLine(Convert.ToHexString(hash)); // 22A2E09F97E933DB48BA6EF24C6BE11A5A10024BD9A6A18E662E94BF3C35F257
}
...

Note that HMACSHA256.Create() does not work on .NET 5+ (System.PlatformNotSupportedException: This platform does not allow the automatic selection of an algorithm).
On .NET Framework it works, but returns an HMAC/SHA1 value by default:

...
using (var hmacSha256 = HMACSHA256.Create()) 
{
     hmacSha256.Key = secret;
     byte[] hash = hmacSha256.ComputeHash(payload);
     Console.WriteLine(ByteArrayToString(hash)); // FF81B9A37F9DA6EA0DE2CFF78216B697722E9A08 // for ByteArrayToString() see https://stackoverflow.com/a/311179/9014097
}
...

这可能是您的环境中哈希值较短的原因.为了使用HMAC/SHA 256，必须明确指定:

...
using (var hmacSha256 = HMACSHA256.Create("HMACSHA256"))
{
    hmacSha256.Key = secret;
    byte[] hash = hmacSha256.ComputeHash(payload);
    Console.WriteLine(ByteArrayToString(hash)); // 22A2E09F97E933DB48BA6EF24C6BE11A5A10024BD9A6A18E662E94BF3C35F257 // for ByteArrayToString() see https://stackoverflow.com/a/311179/9014097
}
...

The reason is that HMACSHA256.Create() calls HMAC.Create(), and the latter requires a specification of the digest, otherwise it defaults to HMAC/SHA1, s. here.
Since new HMACSHA256(secret) works in all environments, it is probably most robust to use this (in accordance with the example in the documentation).