Webhook signature verification in Rest API - Step-by-Step Execution

Concept Flow - Webhook signature verification

Receive webhook request

↓

Extract signature from headers

↓

Compute expected signature using secret and payload

↓

Compare expected signature with received signature

↓

Process webhook

The server receives a webhook, extracts the signature, computes the expected signature using a secret and payload, then compares both to verify authenticity.

Execution Sample

Rest API

import hmac
import hashlib

def verify_signature(secret, payload, signature):
    expected = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

This code checks if the webhook signature matches the expected signature computed with a secret key and payload.

Execution Table

Step	Action	Input	Computed Value	Comparison Result	Decision
1	Receive webhook	payload='data', signature='abc123'	-	-	-
2	Extract signature	signature='abc123'	abc123	-	-
3	Compute expected signature	secret='key', payload='data'	expected='def456'	-	-
4	Compare signatures	expected='def456', received='abc123'	-	No Match	Reject request
5	End	-	-	-	Stop processing

💡 Signatures do not match, so the webhook request is rejected.

Variable Tracker

Variable	Start	After Step 3	After Step 4	Final
secret	key	key	key	key
payload	data	data	data	data
signature	-	abc123	abc123	abc123
expected	-	def456	def456	def456
comparison_result	-	-	No Match	No Match
decision	-	-	Reject request	Reject request

Key Moments - 2 Insights

Why do we compute the expected signature instead of trusting the received one?

Because the received signature could be fake. Computing the expected signature with the secret ensures the webhook is from a trusted source, as shown in step 3 and 4 of the execution_table.

What happens if the signatures match?

If they match, the webhook is accepted and processed. This is the 'Match' branch in the concept_flow diagram, opposite to the 'No Match' path shown in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'expected' after step 3?

A def456

B key

C abc123

D data

💡 Hint

Check the 'Computed Value' column at step 3 in the execution_table.

At which step does the program decide to reject the webhook?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look at the 'Decision' column in the execution_table.

If the received signature matched the expected signature, what would the decision be?

A Compute signature again

B Reject request

C Process webhook

D Stop processing

💡 Hint

Refer to the concept_flow diagram where 'Match' leads to 'Process webhook'.

Concept Snapshot

Webhook signature verification:
- Receive webhook with payload and signature
- Compute expected signature using secret + payload
- Compare expected and received signatures
- If match, process webhook
- If no match, reject request

Full Transcript

Webhook signature verification is a process to confirm that a webhook request is from a trusted source. When the server receives a webhook, it extracts the signature sent in the headers. Then, it computes the expected signature by using a secret key and the payload data with a hashing function. The server compares the expected signature with the received one. If they match, the webhook is accepted and processed. If not, the webhook is rejected to prevent unauthorized actions. This ensures security by verifying authenticity before processing.