MindPress · Gate A · Path 2

Signed Webhook Security

Self-paced classroom reader. Work the scenes in order — interactive sims run sandboxed; quiz answers stay hidden until you submit.

~30–35 min 7 scenes Static · no login
1

Course Overview

Slide

Signed Webhooks — FDE Contractor Training

  • At-least-once delivery risks
  • Gold bars: bad signature, duplicate, poison, clean logs
  • Self-paced practice focus
2

Raw-Body HMAC Verification

Slide
  • Verify before parsing JSON
  • Constant-time comparison
  • Timestamp freshness check
3

HMAC Verification Simulator

Interactive

Runs in a sandboxed frame (scripts allowed; no same-origin access).

\n \n \n \n\n\n\n\n\n\n\n
\n
\n

HMAC Verification Simulator

\n

Implement raw-body HMAC verification for webhook security. Test valid signatures, invalid signatures, and replay protection with timestamp tolerance.

\n
\n\n
\n
\n

Verification Function

\n \n
\n \n Loading Python environment...\n
\n
\n \n
\n

Execution Output

\n
Ready to execute...
\n \n
\n

Test Cases

\n
\n
\n
\n
\n\n
\n \n
Use hmac.new(secret.encode(), body.encode(), hashlib.sha256).hexdigest() to generate the expected signature.
\n
Compare signatures using hmac.compare_digest() to prevent timing attacks.
\n
Check timestamp freshness before verifying the signature to prevent replay attacks.
\n
\n
\n\n\n\n"; })();
4

Idempotency & Retry Semantics

Slide

Durable keys guarantee exactly-once side effects

  • Store idempotency key before processing
  • Reject duplicate after key exists
  • Handle concurrent retries safely
5

Verification & Idempotency Check

Quiz

Question 1 · Choose one · 20 pts

In a webhook handler that receives signed payloads, at which point must the HMAC signature be verified to prevent an attacker from supplying a malicious JSON structure that could be parsed before signature validation?

Question 2 · Select all that apply · 20 pts

Which two practices together prevent duplicate side effects when a webhook delivery is retried by the sender or redelivered from a DLQ?

Question 3 · Choose one · 15 pts

A developer adds debug logging that prints the entire webhook request including the X-Hub-Signature header and the parsed JSON body containing a 'secret' field. Which security violation has occurred?

Question 4 · Select all that apply · 15 pts

Select the two correct statements about handling webhook retries and dead-letter queues while maintaining both security and idempotency.

6

DLQ & Secret Hygiene

Slide
  • Route poison messages to DLQ
  • Log only aggregate totals
  • Never log payloads or signatures
7

Build Secure Webhook Handler

Project · PBL

Production Secure Inbound Webhook Handler

Build a handler that verifies HMAC on raw body, enforces idempotency, routes poison to DLQ, and logs only totals.

What you will gain

  • Perform constant-time signature verification to securely validate webhook authenticity without timing leaks
  • Design durable idempotency mechanisms that prevent duplicate processing across retries and restarts
  • Implement poison message routing to dead-letter queues while preserving original payload integrity
  • Apply secret-free logging practices that record only aggregate metrics and avoid exposing sensitive data
← Track A Lock + HITL Gate Weekly Metrics & Buyer Updates →