The publisher must secure their integration by ensuring that the webhook handler verifies that all requests are generated by . The webhook system provides the following to ensure security and authenticity:
The webhook system generates a signature for the payload using the API key and includes it in the request headers.
The signature allows the webhook receiver to verify the integrity of the request payload to ensure that it has not been tampered with. generates signatures by encoding the payload with a hash-based message authentication code (HMAC) with Secure Hash Algorithm 2 (SHA-256).
The following illustrates what is involved when validating the signature:
The webhook system generates an event_timestamp for the webhook receiver to prevent replay attacks. Since the event_timestamp is included in the payload, any attempt by an attacker to alter the timestamp would invalidate the signature, thus ensuring the integrity of the timestamp.
Compute the difference between the current timestamp and the received timestamp, then decide if the difference is within your tolerance. To protect against timing attacks, use a constant-time-string comparison to compare the expected signature to each of the received signatures.
All time values are in the Coordinated Universal Time (UTC) time zone.
