How should your service verify incoming webhooks from a provider?
Options
- Check the User-Agent header that comes with the request
- Verify an HMAC signature of the raw body, plus a timestamp (Correct option)
- Only accept requests that arrive over a secure HTTPS connection
- Trust any request that is sent to a secret, hard-to-guess URL
Answer
Verify an HMAC signature over the raw body with the shared secret, plus a timestamp to prevent replays
Why
A webhook is the provider calling YOUR URL. Anyone on the internet could call that URL with fake data.
The provider signs each payload with a shared secret (HMAC). You recompute the signature over the raw body and compare (with hmac.compare_digest). If it matches, the data is genuine.
Also reject old timestamps (replayed messages) and handle duplicates, because providers retry.
Remember
Webhooks: verify the HMAC signature, reject old timestamps.