Verifying Webhooks

why verify because of the way webhooks work, attackers can impersonate services by simply sending a fake webhook to an endpoint think about it it's just an http post from an unknown source this is a potential security hole for many applications, or at the very least, a source of problems in order to prevent it, hotmic signs every webhook and its metadata with a unique key for each endpoint this signature can then be used to verify the webhook indeed comes from hotmic, and only process it if it is another potential security hole is what's called replay attacks a replay attack https //en wikipedia org/wiki/replay attack is when an attacker intercepts a valid payload (including the signature), and re transmits it to your endpoint this payload will pass signature validation, and will therefore be acted upon to mitigate this attack, hotmic includes a timestamp for when the webhook attempt occurred our libraries automatically reject webhooks with a timestamp that are more than five minutes away (past or future) from the current time this requires your server's clock to be synchronised and accurate, and it's recommended that you use ntp https //en wikipedia org/wiki/network time protocol to achieve this how to verify for more information about how to verify, review this documentation from our partner https //docs svix com/receiving/verifying payloads/how