Simple Ways to Make Webhook Security Better

Scott McAllister introduces webhooks as HTTP callbacks in which a provider pushes event notifications to an endpoint the consumer supplies. A plain listener has no built-in way to know whether a request truly came from the provider, whether its contents were changed, or whether it was replayed. He demonstrates this with a small note app receiving real Twilio text messages, then sends a hand-crafted POST that the app accepts just as readily.

The core of the talk surveys verification patterns gathered from more than a hundred providers. He covers one-time endpoint verification at subscription time, shared secrets, HMAC signatures over the request body, asymmetric key signing, mutual TLS, data-less notifications that require a follow-up API call, and timestamp-based replay prevention. For each he weighs setup effort, what it protects and where it falls short, such as missing confidentiality or the burden of key rotation. HMAC is the most common choice in the research.

He closes with advice for both sides: providers should document verification thoroughly and show it end to end, and consumers should use whatever checks a provider offers. In the demo, adding token-based verification causes unsigned requests to return 403 Forbidden, both in a local development setup and in a production setup using an SDK-driven tunnel.