Webhook Authentication

Overview

Meaning in plain language

Webhook authentication enables a recipient to verify that a webhook request came from the expected sender under an established trust relationship. Common mechanisms include message authentication codes over the payload, digital signatures, mutual TLS, and authenticated gateway credentials.

How it works

Common mechanisms include message authentication codes over the payload, digital signatures, mutual TLS, and authenticated gateway credentials. Verification should cover the exact received bytes and bind relevant metadata such as timestamp, event identifier, destination, or protocol version.

A shared secret in an ordinary header is vulnerable if requests can be observed or replayed. Parsing and reserializing content before verification, accepting multiple ambiguous encodings, skipping failed checks, or exposing secrets in logs can make apparently authenticated requests unsafe.

Recipients should verify signatures before processing, use constant-time comparison where appropriate, enforce freshness and replay protection, rotate keys safely, and fail closed. Key identifiers, algorithm versions, canonicalization rules, and secret distribution need explicit documentation and monitored migration.

For Webhook Authentication, the trust decision should establish Webhook authentication enables a recipient to verify that a webhook request came from the expected sender under an established trust relationship.

Review of Webhook Authentication should compare permitted and rejected actions related to identity proof and credential state, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.

Where people get it wrong

Do not trust the source IP alone or assume that HTTPS proves the sender. Validate the original request body, replay window and expected merchant context.

Related concepts

Request Signature, Webhook Signature Error, Webhook Verification.

Reference

OWASP API Security Top 10 (2023).