🎁 New User? Get 20% off your first purchase with code NEWUSER20 · ⚡ Instant download · 🔒 Secure checkout Register Now →
Menu

Categories

Security Intermediate

What is Webhook Signature Verification?

A security mechanism that verifies webhook payloads are authentic and unmodified using cryptographic signatures.

Webhook signature verification ensures incoming webhook requests genuinely come from the expected service and have not been tampered with. The sender creates a signature (HMAC-SHA256) using the payload and a shared secret, included in a header.

The receiver recalculates the signature using the same secret and compares. If they match, the webhook is authentic. Services like Stripe (Stripe-Signature), GitHub (X-Hub-Signature-256), and PayPal use this pattern. Always verify signatures to prevent spoofed webhook attacks.

Related Terms

OAuth 2.0
An authorization framework that allows third-party applications to access user resources without sharing passwords.
Supply Chain Attack
A cyberattack that targets less-secure elements in the software supply chain to compromise downstream users and organizations.
SQL Injection
An attack where malicious SQL code is inserted into application queries through user input to access or manipulate the database.
Content Security Policy (CSP)
An HTTP security header that controls which resources a browser is allowed to load for a web page, preventing XSS and data injection.
DDoS (Distributed Denial of Service)
An attack that floods a target server or network with traffic from multiple sources to overwhelm it and deny service to legitimate users.
OWASP Top 10
A regularly updated list of the ten most critical web application security risks, published by the Open Web Application Security Project.
 View All Security Terms →