Webhooks

2 articles

Cybersecurity 20 Sep 2026 6 min read

Webhook HMAC Signatures Need Replay Controls

Webhook HMAC Signatures Need Replay Controls A webhook receiver often needs to decide whether an HTTP request came from a configured sender and whether the payload changed in transit. A keyed message authentication code can support that decision when both sides share a secret and compute the tag over the same bytes. That property does not make a captured request single-use. If an attacker records a valid request and submits the same authenticated material again, the tag can remain valid. Replay resistance therefore has to be part of the webhook protocol around the MAC, not an assumption attached to the MAC itself.

Cybersecurity Webhooks

Cybersecurity 03 Sep 2026 9 min read

Authenticate Webhooks with Signed Requests

A webhook endpoint is often intentionally reachable from the internet. That makes delivery convenient, but it also means the endpoint cannot assume that every request came from the service it trusts. If an application processes an unsigned webhook simply because it arrived at the correct URL, anyone who discovers that URL may be able to submit lookalike events. Depending on the integration, a forged event could trigger account changes, fulfilment, notifications, billing workflows, or other automated actions.

Cybersecurity Authentication