Brief #11 · Security
Secure Webhook System (HMAC)
Easy⏱ 5-8 hSoon
Accept 'payment succeeded' webhooks only when they really came from your provider, and only once.
Outlines are free · building with tracking needs Pro
SThe briefFrom the team
Our payment provider calls /webhooks/payment when a payment succeeds, and we mark the order paid. Right now anyone who finds that URL can mark any order paid with a curl command. Make the endpoint reject anything forged, tampered with, or replayed.
What you'll build
- 1A sender that signs
timestamp.bodywith HMAC-SHA256 and a shared secret. - 2A receiver that verifies the signature with a constant-time comparison.
- 3Reject messages older than 5 minutes, and remember event IDs to block replays.
- 4Support two active secrets so you can rotate without downtime.
- 5Respond fast and process the event in the background.
Step-by-step walkthrough
Walkthrough coming soon
This project's step-by-step walkthrough, with real outputs at every step, is still being written. You can read the brief and try it on your own meanwhile; tracking opens when the walkthrough is ready.
Done when
- Tests prove a forged, a tampered and a replayed message are each rejected.
- The signature is checked against the raw body, before JSON parsing.
- Rotating the secret causes zero failed deliveries.
- A README shows how to verify with curl and openssl.
Stretch goals
- Retry delivery with exponential backoff on the sender side.
- A dead-letter queue for events that keep failing.