bug fix in HmacAuthenticationHandler

Author: pwelter34

README.md

@@ -6,7 +6,6 @@ A HMAC (Hash-based Message Authentication Code) authentication system for ASP.NE
 [![License](https://img.shields.io/github/license/loresoft/HashGate.svg)](https://github.com/loresoft/HashGate/blob/main/LICENSE)
 [![Coverage Status](https://coveralls.io/repos/github/loresoft/HashGate/badge.svg?branch=main)](https://coveralls.io/github/loresoft/HashGate?branch=main)
 
-
 | Package                                                                    | Version                                                                                                                 | Description                                                   |
 | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
 | [HashGate.AspNetCore](https://www.nuget.org/packages/HashGate.AspNetCore/) | [![NuGet](https://img.shields.io/nuget/v/HashGate.AspNetCore.svg)](https://www.nuget.org/packages/HashGate.AspNetCore/) | Server-side HMAC authentication for ASP.NET Core applications |

src/HashGate.AspNetCore/HmacAuthenticationHandler.cs

@@ -139,16 +139,21 @@ private async Task<string> GenerateContentHash()
         // Ensure the request body can be read multiple times
         Request.EnableBuffering();
 
+        // Return empty content hash if there is no body
+        if (Request.ContentLength == 0 || Request.Body == Stream.Null)
+            return HmacAuthenticationShared.EmptyContentHash;
 
         await using var memoryStream = new MemoryStream();
-        await Request.Body.CopyToAsync(memoryStream).ConfigureAwait(false);
+        await Request.BodyReader.CopyToAsync(memoryStream).ConfigureAwait(false);
 
         // Reset position after reading
         Request.Body.Position = 0;
 
-        var hashBytes = SHA256.HashData(memoryStream.ToArray());
+        // If the body is empty after reading, return empty content hash
+        if (memoryStream.Length == 0)
+            return HmacAuthenticationShared.EmptyContentHash;
 
-        var json = Encoding.UTF8.GetString(memoryStream.ToArray());
+        var hashBytes = SHA256.HashData(memoryStream.ToArray());
 
         // 32 bytes SHA256 -> 44 chars base64
         Span<char> base64 = stackalloc char[44];