Webhook Endpoints Validate Sender

Webhook endpoints that process payloads without verifying the sender's signature accept forged requests from anyone who knows the endpoint URL. An attacker can POST a fabricated payment_succeeded event to trigger order fulfillment without paying, or a user.deleted event to wipe accounts. CWE-345 (Insufficient Verification of Data Authenticity) and CWE-347 (Improper Verification of Cryptographic Signature) define this failure. OWASP A02 (Cryptographic Failures) covers the broader category. NIST 800-53 SC-8 requires data integrity protection in transit — webhook signature verification is the enforcement mechanism for inbound event streams.

Verify the webhook signature before processing any payload. Read the body as raw text before parsing — webhook providers sign the raw bytes, and parsing first invalidates the signature.

// app/api/webhooks/stripe/route.ts
export async function POST(req: NextRequest) {
  const body = await req.text(); // Raw text — not req.json()
  const signature = req.headers.get('stripe-signature');

  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(body, signature!, process.env.STRIPE_WEBHOOK_SECRET!);
  } catch (err) {
    return NextResponse.json({ error: 'Signature verification failed' }, { status: 400 });
  }

  // Safe to process event.type
}

Every major webhook provider (Stripe, Clerk, GitHub, Svix) offers a signature mechanism — use the provider's official SDK method rather than rolling your own HMAC check.