Hmac libraries expect the message to be a string. It protects you against length extension attacks (& co). This was a bug in how they converted a map(string -> string) to a single string to sign. Hmac or not, you'd still need that, and if your bug is in there, no hmac will protect you.