TL;DR
Never trust unverified webhooks. Always verify signatures before processing payloads, validate the payload structure, handle events idempotently, and respond quickly to avoid timeouts. 4 critical items must be fixed before launch, 5 important items within the first week, and 3 recommended items when you can.
Quick Checklist (5 Critical Items)
Signature Verification 4
Payload Handling 4
Endpoint Security 4
Webhooks Are Attack Vectors
Your webhook endpoint is publicly accessible. Anyone can send POST requests to it. Without signature verification, attackers can spoof events and trick your system into taking actions. A fake payment webhook could grant access without payment.
Always verify signatures. It is the only way to know the webhook came from the expected source. Most providers sign their webhooks. Use this mechanism.
Why do I need to verify webhook signatures?
Anyone can send POST requests to your webhook endpoint. Without signature verification, attackers can spoof events. Signature verification proves the webhook came from the expected source, not a malicious actor.
What does idempotent webhook handling mean?
Idempotent handling means processing the same webhook multiple times produces the same result. Webhook providers may retry on failure, sending the same event multiple times. Your handler must not charge customers twice or create duplicate records.
What if my webhook handler is slow?
Return 200 immediately after signature verification, then process the event asynchronously using a job queue. Slow responses can trigger timeouts and retries, causing duplicate processing.