security // Webhook SecuritySTUDY

Webhook HMAC Verification — Canonical Pattern

Verify that an inbound webhook body was signed by the expected sender before processing side effects.

webhookhmacsecuritysignature

Trust & provenanceSTUDY

Evidence tierSTUDYOfficial sources0Other sources0Last verified2026-10-05

Evidence tier describes my hands-on relationship with the content. Official sources describe platform contracts/documentation. Production observations should not automatically be treated as official limits.

EvidenceSTUDY

Difficultyintermediate

Verified2026-10-05

Use when

The external provider supports request signing and you need tamper detection/authenticity.

import crypto from 'node:crypto';

function validSignature(rawBody, received, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(received, 'hex')
  );
}

Why it works

The receiver recomputes the MAC using a shared secret and compares it against the sender-provided signature.

Operational notes

Use the exact raw body format required by the provider before parsing/re-serializing JSON.

Reject missing/malformed signatures before running business logic.

Webhook HMAC Verification — Canonical Pattern

Keep following the context.