Hi ribble,

a couple of years ago (2 or 3 years), I came up with the following code. I just remember that it worked. Now I'm too lazy to study it again... ;-) I think it's self explanatory. The point is writing out the HMAC in correct base64. As you already noted, playing with HMAC's require checking against reference HMAC's calculations and values in order to get it right.

Have fun!

#!/usr/bin/env perl

use strict;
use warnings;

use HTTP::Tiny;
use Digest::SHA qw( hmac_sha256_base64 );


my $url = shift(@ARGV) || 'http://localhost:8080/saf/CreditWeb?url=htt
+p://127.0.0.39:39090/some_files/inotify.pdf&mini=1';

my $digest = hmac_sha256_base64("SaF14202", "manyana");

while (length($digest) % 4) {
    $digest .= '=';
}
print "digest: $digest\n";

my %headers = ( SAFHMAC => $digest );

my $response = HTTP::Tiny->new->get($url, { headers => \%headers });

print "$response->{status} $response->{reason}\n";

while (my ($k, $v) = each %{$response->{headers}}) {
    for (ref $v eq 'ARRAY' ? @$v : $v) {
        print "$k: $_\n";
    }
}

#print $response->{content} if length $response->{content};

__END__
[download]