Webhook signature verification in Rest API - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the module needed for HMAC.

Rest API

import [1]

Drag options to blanks, or click blank then click option'

Ahmac

Brequests

Cjson

Dhashlib

Attempts:

3 left

💡 Hint

Common Mistakes

Importing hashlib instead of hmac

Forgetting to import any module

The hmac module is used to create and verify message signatures.

2fill in blank

medium

Complete the code to create an HMAC object using the secret key and message.

Rest API

signature = hmac.new([1], message, hashlib.sha256).hexdigest()

Drag options to blanks, or click blank then click option'

Asecret_key

Bmessage

Chashlib

Dsignature

Attempts:

3 left

💡 Hint

Common Mistakes

Using the message as the key

Using hashlib instead of the key

The secret key is used as the key argument in hmac.new to create the signature.

3fill in blank

hard

Fix the error in the code to correctly compare the computed signature with the received signature.

Rest API

if hmac.compare_digest(signature, [1]):
    print('Valid signature')

Drag options to blanks, or click blank then click option'

Amessage

Bsignature

Csecret_key

Dreceived_signature

Attempts:

3 left

💡 Hint

Common Mistakes

Comparing the signature to itself

Comparing signature to message or secret key

We compare the computed signature with the received_signature from the webhook.

4fill in blank

hard

Fill both blanks to decode the received signature from hex and compare it safely.

Rest API

received_sig_bytes = bytes.fromhex([1])
if hmac.compare_digest(signature_bytes, [2]):
    print('Signature verified')

Drag options to blanks, or click blank then click option'

Areceived_signature

Bsignature_bytes

Creceived_sig_bytes

Dsecret_key

Attempts:

3 left

💡 Hint

Common Mistakes

Comparing hex string directly without decoding

Mixing up variable names

The received signature string is converted to bytes using bytes.fromhex. Then we compare the computed signature_bytes with received_sig_bytes.

5fill in blank

hard

Fill all three blanks to create a function that verifies a webhook signature.

Rest API

def verify_signature(secret, message, [1]):
    computed_sig = hmac.new(secret, message, [2]).hexdigest()
    return hmac.compare_digest(computed_sig, [3])

Drag options to blanks, or click blank then click option'

Areceived_signature

Bhashlib.sha256

Dmessage

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong parameter names

Not using the correct hashing algorithm

Comparing wrong variables

The function takes the received signature as an argument. It uses hashlib.sha256 to create the HMAC digest. Finally, it compares the computed signature with the received one.