x-pack/filebeat/input/http_endpoint: add support for base64-encoded H…

…MAC headers

CHANGELOG.next.asciidoc

@@ -278,6 +278,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Improve reindexing support in security module pipelines. {issue}38224[38224] {pull}[]
 - Improve reindexing support in security module pipelines. {issue}38224[38224] {pull}39588[39588]
 - Make HTTP Endpoint input GA. {issue}38979[38979] {pull}39410[39410]
+- Add support for base64-encoded HMAC headers to HTTP Endpoint. {pull}39655[39655]
 
 *Auditbeat*
 

x-pack/filebeat/input/http_endpoint/validate.go

@@ -9,6 +9,7 @@ import (
 	"crypto/hmac"
 	"crypto/sha1"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -69,7 +70,7 @@ func (v *apiValidator) validateRequest(r *http.Request) (status int, err error)
 		if v.hmacPrefix != "" {
 			hmacHeaderValue = strings.TrimPrefix(hmacHeaderValue, v.hmacPrefix)
 		}
-		signature, err := hex.DecodeString(hmacHeaderValue)
+		signature, err := decodeHeaderValue(hmacHeaderValue)
 		if err != nil {
 			return http.StatusUnauthorized, fmt.Errorf("invalid HMAC signature hex: %w", err)
 		}
@@ -104,3 +105,22 @@ func (v *apiValidator) validateRequest(r *http.Request) (status int, err error)
 
 	return http.StatusAccepted, nil
 }
+
+// decoders is the priority-ordered set of decoders to use for HMAC header values.
+var decoders = [...]func(string) ([]byte, error){
+	hex.DecodeString,
+	base64.RawStdEncoding.DecodeString,
+	base64.StdEncoding.DecodeString,
+}
+
+func decodeHeaderValue(s string) ([]byte, error) {
+	var errs []error
+	for _, d := range &decoders {
+		b, err := d(s)
+		if err == nil {
+			return b, nil
+		}
+		errs = append(errs, err)
+	}
+	return nil, errors.Join(errs...)
+}