Webhook delivery handling
Verify the signature before trusting the webhook payload
A public endpoint must establish who sent the request and which account it concerns. Valid JSON and a familiar event name provide neither assurance.
In this article
Use the provider's exact verification contract
Preserve the body representation and signature headers required by the provider. Use its supported library or documented algorithm and comparison method.
GitHub documents validating deliveries with the configured webhook secret. Stripe's verification depends on the raw request body. Middleware that parses and reserialises JSON can break schemes that authenticate the original bytes.
Test through the actual framework and proxy path rather than only calling the verifier with a fixture in isolation.
Bound untrusted input
Apply reasonable request-size and processing limits before expensive work. Reject malformed signatures and unsupported input without logging full untrusted payloads by default.
Keep secret selection tied to trusted endpoint configuration or a carefully validated source mapping. An arbitrary payload field should not grant access to every signing secret.
Protect verification keys and rotate them under the provider's supported transition model.
Check scope after authenticity
A valid signature does not mean the application should perform every action described. Validate the event type, expected account and mapping to the local organisation.
Use the least authority needed for the resulting operation. A webhook about one account must not become an unrestricted instruction to modify another tenant's records.
Treat URLs or resource references in payloads according to the provider contract and normal outbound access controls. Do not fetch arbitrary destinations merely because they appear in a signed object.
Test replay and disclosure behaviour
Use the provider's timestamp or replay protections where applicable and maintain application duplicate handling. These address different aspects of repeated delivery.
Inspect error responses, logs and dead-letter records for sensitive content. Verified payloads can still contain information that should not be broadly retained.
The review should establish authenticity, scope and safe processing together. Signature verification is essential, but it is the start of the application's trust decision rather than permission to execute every payload field.
Primary sources
GitHub: validating webhook deliveriesStripe: webhook handlingReferences checked 11 September 2026.