TL;DR
Never trust unverified webhooks. Always verify signatures before processing payloads, validate the payload structure, handle events idempotently, and respond quickly to avoid timeouts. 4 critical items must be fixed before launch, 5 important items within the first week, and 3 recommended items when you can.
Webhooks are basically strangers knocking on your door claiming to be from Stripe or GitHub. Without signature verification, you have no idea if that is actually true. This checklist walks through the security patterns that keep your webhook endpoints from becoming an open invitation for spoofed requests.
Quick Checklist (5 Critical Items)
Signature Verification 4
Payload Handling 4
Endpoint Security 4
Webhooks Are Attack Vectors
Your webhook endpoint is publicly accessible. Anyone can send POST requests to it. Without signature verification, attackers can spoof events and trick your system into taking actions. A fake payment webhook could grant access without payment.
Always verify signatures. It is the only way to know the webhook came from the expected source. Most providers sign their webhooks. Use this mechanism.
Why do I need to verify webhook signatures?
Anyone can send POST requests to your webhook endpoint. Without signature verification, attackers can spoof events. Signature verification proves the webhook came from the expected source, not a malicious actor.
What does idempotent webhook handling mean?
Idempotent handling means processing the same webhook multiple times produces the same result. Webhook providers may retry on failure, sending the same event multiple times. Your handler must not charge customers twice or create duplicate records.
What if my webhook handler is slow?
Return 200 immediately after signature verification, then process the event asynchronously using a job queue. Slow responses can trigger timeouts and retries, causing duplicate processing.
Scan Your Webhook Endpoints
Check for common webhook security misconfigurations.