Webhook Security Guide

import crypto from 'crypto';

function verifyWebhookSignature(
  payload: string,
  signatureHeader: string,
  secret: string
): boolean {
  // Parse "v1,{base64}" format
  const parts = signatureHeader.split(',');
  const version = parts[0];
  const signature = parts[1];

  if (version !== 'v1') return false;

  // Compute expected signature
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('base64');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express middleware
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['webhook-signature'] as string;
  const secret = 'whsec_your_signing_secret';

  if (!verifyWebhookSignature(req.body.toString(), signature, secret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Process the webhook
  const event = JSON.parse(req.body);
  console.log('Verified event:', event.event);
  res.status(200).json({ received: true });
});

import hmac
import hashlib
import base64
import type { Metadata } from 'next';

// Revalidate every hour for ISR
export const revalidate = 3600;


export const metadata: Metadata = {
  title: 'Security',
  description: 'How HookSniff secures your webhook deliveries with signatures and encryption',
};


def verify_webhook_signature(
    payload: bytes,
    signature_header: str,
    secret: str
) -> bool:
    """Verify Standard Webhooks HMAC-SHA256 signature."""
    parts = signature_header.split(',')
    if len(parts) != 2 or parts[0] != 'v1':
        return False

    signature = parts[1]

    # Compute expected signature
    expected = base64.b64encode(
        hmac.new(
            secret.encode('utf-8'),
            payload,
            hashlib.sha256
        ).digest()
    ).decode('utf-8')

    return hmac.compare_digest(signature, expected)

# Flask example
from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('webhook-signature', '')
    secret = 'whsec_your_signing_secret'

    if not verify_webhook_signature(request.data, signature, secret):
        abort(401)

    event = request.json
    return {'received': True}, 200

function isTimestampValid(timestampHeader: string, toleranceSec = 300): boolean {
  const webhookTime = parseInt(timestampHeader, 10);
  const now = Math.floor(Date.now() / 1000);
  return Math.abs(now - webhookTime) <= toleranceSec;
}

// In your handler:
const timestamp = req.headers['webhook-timestamp'] as string;
if (!isTimestampValid(timestamp)) {
  return res.status(401).json({ error: 'Timestamp expired' });
}

# Fetch current outbound IPs
curl https://hooksniff-api-1046140057667.europe-west1.run.app/v1/outbound-ips