Webhook signature

A webhook is a request your app receives from another service. A webhook signature is a value in the headers, computed with a shared secret, that proves the request came from that service and was not changed on the way.

Without the check, your endpoint accepts anyone. An address that grants paid access on receipt of a message is a free product for whoever finds the URL, and public endpoints are found.

Verifying means recomputing the signature from the raw body and comparing it in a way that does not leak timing. It must happen before you parse anything or write anything. A check from outside cannot see whether you do it, so this stays on the not-verified list until a review reads the handler.

No incident in the library maps to this one yet.