Webhook signature verification in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this HMAC signature verification code?

Given the following Python code snippet that verifies a webhook signature, what will be printed?

Rest API

import hmac
import hashlib

secret = b'supersecret'
payload = b'{"order_id":1234}'
signature = '5f4dcc3b5aa765d61d8327deb882cf99'

computed = hmac.new(secret, payload, hashlib.sha256).hexdigest()

if hmac.compare_digest(computed, signature):
    print("Signature valid")
else:
    print("Signature invalid")

A Signature valid

B SyntaxError

C TypeError

D Signature invalid

💡 Hint

Check if the given signature matches the computed HMAC SHA256 digest.

The given signature is a fixed MD5 hash string, which does not match the computed HMAC SHA256 digest. So the output is "Signature invalid".

🧠 Conceptual

intermediate

Which hashing algorithm is best for webhook signature verification?

When verifying webhook signatures, which hashing algorithm is recommended for security and integrity?

A MD5

B SHA256

C Base64

D SHA1

💡 Hint

Consider modern security standards and collision resistance.

SHA256 is a secure and widely recommended hashing algorithm for webhook signature verification due to its strong collision resistance compared to MD5 and SHA1.

🔧 Debug

advanced

What error does this webhook signature verification code raise?

Examine the following JavaScript code snippet for verifying a webhook signature. What error will it raise when run?

Rest API

import crypto from 'crypto';

const secret = 'topsecret';
const payload = JSON.stringify({ id: 42 });
const signature = 'abcdef123456';

const hmac = crypto.createHmac('sha256', secret);
hmac.update(payload);
const digest = hmac.digest('hex');

if (digest === signature) {
  console.log('Valid signature');
} else {
  console.log('Invalid signature');
}

// Now try to call hmac.update(payload) again
hmac.update(payload);

A ReferenceError: crypto not defined

B No error, prints 'Invalid signature'

C TypeError: Digest already called

D SyntaxError

💡 Hint

Check if the crypto HMAC object can be reused after calling digest().

In Node.js, calling digest() finalizes the HMAC object. Calling update() again after digest() causes a TypeError: Digest already called.

📝 Syntax

advanced

Which Python code snippet correctly verifies a webhook signature?

Choose the option that correctly verifies a webhook signature using HMAC SHA256 in Python.

A hmac.compare_digest(hmac.new(secret, payload, hashlib.sha256).hexdigest(), signature)

B hmac.new(secret, payload, hashlib.sha256).hexdigest() == signature

C hmac.new(secret, payload, hashlib.sha256).digest() == signature

D hmac.compare_digest(hmac.new(secret, payload, hashlib.sha256).digest(), signature)

💡 Hint

Consider the difference between digest() and hexdigest(), and how to safely compare signatures.

Option A uses hexdigest() to get a hex string and compares it safely with the given signature using hmac.compare_digest(), which prevents timing attacks.

🚀 Application

expert

How many valid webhook signatures are possible with a 256-bit HMAC?

Assuming a webhook uses an HMAC with SHA256 producing a 256-bit signature, how many unique valid signatures can exist?

A 2^256

B 2^128

C 2^512

D 2^64

💡 Hint

Think about the output size of SHA256 in bits and how many unique outputs it can produce.

SHA256 produces a 256-bit output, so there are 2^256 possible unique signatures.