Webhook signature verification in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this HMAC signature verification code?

Given the following Python code snippet that verifies a webhook signature, what will be printed?

Rest API

import hmac
import hashlib

secret = b'supersecret'
payload = b'{"order_id":1234}'
signature = '5f4dcc3b5aa765d61d8327deb882cf99'

computed = hmac.new(secret, payload, hashlib.sha256).hexdigest()

if hmac.compare_digest(computed, signature):
    print("Signature valid")
else:
    print("Signature invalid")

A Signature valid

B SyntaxError

C TypeError

D Signature invalid

💡 Hint

Check if the given signature matches the computed HMAC SHA256 digest.

The given signature is a fixed MD5 hash string, which does not match the computed HMAC SHA256 digest. So the output is "Signature invalid".

🧠 Conceptual

intermediate

Which hashing algorithm is best for webhook signature verification?

When verifying webhook signatures, which hashing algorithm is recommended for security and integrity?

A MD5

B SHA256

C Base64

D SHA1

💡 Hint

Consider modern security standards and collision resistance.

SHA256 is a secure and widely recommended hashing algorithm for webhook signature verification due to its strong collision resistance compared to MD5 and SHA1.

🔧 Debug

advanced

What error does this webhook signature verification code raise?

Examine the following JavaScript code snippet for verifying a webhook signature. What error will it raise when run?

Rest API

import crypto from 'crypto';

const secret = 'topsecret';
const payload = JSON.stringify({ id: 42 });
const signature = 'abcdef123456';

const hmac = crypto.createHmac('sha256', secret);
hmac.update(payload);
const digest = hmac.digest('hex');

if (digest === signature) {
  console.log('Valid signature');
} else {
  console.log('Invalid signature');
}

// Now try to call hmac.update(payload) again
hmac.update(payload);

A ReferenceError: crypto not defined

B No error, prints 'Invalid signature'

C TypeError: Digest already called

D SyntaxError

💡 Hint

Check if the crypto HMAC object can be reused after calling digest().

In Node.js, calling digest() finalizes the HMAC object. Calling update() again after digest() causes a TypeError: Digest already called.

📝 Syntax

advanced

Which Python code snippet correctly verifies a webhook signature?

Choose the option that correctly verifies a webhook signature using HMAC SHA256 in Python.

A hmac.compare_digest(hmac.new(secret, payload, hashlib.sha256).hexdigest(), signature)

B hmac.new(secret, payload, hashlib.sha256).hexdigest() == signature

C hmac.new(secret, payload, hashlib.sha256).digest() == signature

D hmac.compare_digest(hmac.new(secret, payload, hashlib.sha256).digest(), signature)

💡 Hint

Consider the difference between digest() and hexdigest(), and how to safely compare signatures.

Option A uses hexdigest() to get a hex string and compares it safely with the given signature using hmac.compare_digest(), which prevents timing attacks.

🚀 Application

expert

How many valid webhook signatures are possible with a 256-bit HMAC?

Assuming a webhook uses an HMAC with SHA256 producing a 256-bit signature, how many unique valid signatures can exist?

A 2^256

B 2^128

C 2^512

D 2^64

💡 Hint

Think about the output size of SHA256 in bits and how many unique outputs it can produce.

SHA256 produces a 256-bit output, so there are 2^256 possible unique signatures.

Practice

1. What is the main purpose of webhook signature verification?

easy

A. To confirm the webhook is from a trusted source

B. To speed up the webhook delivery

C. To encrypt the webhook payload

D. To log the webhook request time

Solution

1. Step 1: Understand webhook security

   Webhook signature verification is used to check if the webhook request is really from the expected sender.

2. Step 2: Identify the purpose of verification

   This process confirms the webhook is trusted by comparing the signature with a secret key.

3. Final Answer:

   To confirm the webhook is from a trusted source -> Option A

4. Quick Check:

   Verification = Trusted source confirmation [OK]

Hint: Verification means checking trust, not speed or encryption [OK]

Common Mistakes:

• Confusing verification with encryption
• Thinking it speeds up webhook delivery
• Assuming it logs request time

2. Which of the following is the correct Python code snippet to compute an HMAC SHA256 signature for webhook verification?

easy

A. hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()

B. hmac.new(payload.encode(), secret.encode(), hashlib.md5).hexdigest()

C. hashlib.sha256(secret + payload).hexdigest()

D. hmac.sha256(secret, payload).hexdigest()

Solution

1. Step 1: Understand HMAC function parameters

   The correct order is secret key first, then message (payload), and the hashing algorithm.

2. Step 2: Identify correct syntax and algorithm

   hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest() uses hmac.new with secret encoded, payload encoded, and hashlib.sha256, which is correct.

3. Final Answer:

   hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest() -> Option A

4. Quick Check:

   Secret first, payload second, SHA256 used [OK]

Hint: Secret key is first argument in hmac.new() [OK]

Common Mistakes:

• Swapping secret and payload order
• Using wrong hash function like md5
• Incorrect function call syntax

3. Given the following Python code snippet, what will be the output if the signature matches the computed HMAC?

import hmac
import hashlib

secret = "mysecret"
payload = "testdata"
signature = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
computed = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
if computed == signature:
    print("Signature verified")
else:
    print("Signature mismatch")

medium

A. None

B. "Signature verified"

C. RuntimeError

D. "Signature mismatch"

Solution

1. Step 1: Analyze the signature comparison

   The code compares the computed signature with the received signature and prints "Signature verified" if they match.

2. Step 2: Determine output when signatures match

   Since the signatures match, the output will be the success message "Signature verified".

3. Final Answer:

   "Signature verified" -> Option B

4. Quick Check:

   Matching signatures print verification message [OK]

Hint: Match means print verified message [OK]

Common Mistakes:

• Confusing mismatch message as output
• Expecting an error instead of message
• Assuming no output (None)

4. Identify the error in this Python webhook verification snippet:

import hmac
import hashlib

secret = "mysecret"
payload = "data"
signature = "abc123"

computed = hmac.new(secret, payload.encode(), hashlib.sha256).hexdigest()
if computed == signature:
    print("Verified")
else:
    print("Not verified")

medium

A. payload should not be encoded

B. hashlib.md5 should be used instead of sha256

C. secret should be encoded before use in hmac.new

D. signature comparison should use != instead of ==

Solution

1. Step 1: Check data types for hmac.new

   hmac.new requires the secret key as bytes, but secret is a string and not encoded.

2. Step 2: Identify correct fix

   Encoding secret with secret.encode() fixes the error; payload encoding is correct.

3. Final Answer:

   secret should be encoded before use in hmac.new -> Option C

4. Quick Check:

   Secret must be bytes, so encode it [OK]

Hint: Encode secret string before hmac.new call [OK]

Common Mistakes:

• Not encoding secret key
• Changing payload encoding incorrectly
• Using wrong hash function
• Wrong comparison operator

5. You receive webhook requests with a signature header. To securely verify the webhook, which steps should you perform in order? Select the correct sequence.

hard

A. 1. Retrieve secret key
2. Compare signatures
3. Compute HMAC of payload
4. Accept webhook if signatures do not match

B. 1. Accept webhook
2. Compute HMAC of payload
3. Compare signatures
4. Log the webhook

C. 1. Compute HMAC of payload
2. Retrieve secret key
3. Compare signatures
4. Reject webhook if signatures match

D. 1. Retrieve the secret key
2. Compute HMAC of the payload using the secret
3. Compare computed signature with header signature
4. Accept webhook if signatures match

Solution

1. Step 1: Retrieve the secret key

   You need the secret key first to compute the HMAC signature.

2. Step 2: Compute HMAC of the payload using the secret

   Use the secret key and payload to compute the signature.

3. Step 3: Compare computed signature with header signature

   Check if the computed signature matches the one sent in the webhook header.

4. Step 4: Accept webhook if signatures match

   Only accept the webhook if the signatures are the same to ensure trust.

5. Final Answer:

   1. Retrieve the secret key 2. Compute HMAC of the payload using the secret 3. Compare computed signature with header signature 4. Accept webhook if signatures match -> Option D

6. Quick Check:

   Secret -> Compute -> Compare -> Accept [OK]

Hint: Always compute signature before comparing and accepting [OK]

Common Mistakes:

• Accepting webhook before verification
• Comparing before computing signature
• Rejecting on matching signatures