Skip to main content

​
Why should I verify webhooks?

Webhooks are vulnerable because attackers can send fake HTTP POST requests to endpoints, pretending to be legitimate services. This can lead to security risks or operational issues. To mitigate this, each webhook and its metadata are signed with a unique key specific to the endpoint. This signature helps verify the source of the webhook, allowing only authenticated webhooks to be processed. Another security concern is replay attacks, where intercepted valid payloads, complete with their signatures, are resent to endpoints. These payloads would pass the signature verification and be executed, posing a potential security threat.

​
Verify webhooks in your app

To verify the webhook request, you have to use the secret and deconstruct the Svix headers, and Base64-decode the Getmany secret. The example below is for Javascript. Learn more and view all supported languages here. First, install the Svix libraries.
Then, verify the webhooks using the code below. The payload is the raw (string) body of the request, and the headers are the headers passed in the request.
Make sure that you’re using the raw request body when verifying webhooks, since the cryptographic signature is sensitive to even the slightest change. Watch out for frameworks that parse the request as JSON and then stringify it, since this too will break the signature verification.
If you prefer, you can also manually verify the headers as well.