I'm writing a CGI script (Perl on Apache, no other framework) that's supposed to be a webhook endpoint. The technical details are it's supposed to receive events from a Shopify store, but that's semi-irrelevant. Shopify tells me that in order to verify that the webhook came from them, I need to calculate the HMAC using a secret key they provide, and make sure it matches the value in the
Plain apache sets environment variables for HTTP headers. Try it without any wrapper first. You might also try
#!/usr/bin/perl use Data::Dumper; print "Content-type: text/html\r\n\r\n".Dumper(\%ENV);
Call printenv or your script manually to check if the caller might cause the problem:
curl -H "Foo: Bar" http://localhost/cgi-bin/printenv.cgi
You might also want to dump to a file if your script is being called as API.