Q49: How do you secure incoming Webhooks using HMAC signatures?
Webhooks transmit event notifications across public internet endpoints without standard token redirects.
HMAC Webhook Security Pattern:
- Provider and consumer share a secret signing key (
webhook_secret). - Provider computes
signature = HMAC-SHA256(webhook_secret, request_body)and attaches it in headerX-Signature-256. - Consumer reads raw HTTP request body buffer, recomputes the HMAC-SHA256 hash locally, and performs a constant-time string comparison (
timingSafeEqual) against the header signature.
Key Takeaways
- HMAC webhooks verify payload integrity and origin authenticity.
- Always use constant-time comparison functions (
crypto.timingSafeEqual) to prevent timing attack vulnerabilities.