You are accepting webhooks from two hundred partners. Threat model the ingestion pipeline - what are you actually defending against, and what does the endpoint have to do before it trusts a payload?
The endpoint is an unauthenticated internet-facing entry point that writes to your core systems, so treat every field as attacker-controlled. Verify an HMAC over the raw body in constant time, reject stale timestamps, deduplicate on event id, bound the body size, and hand off to a queue rather than processing inline.
Answer
Short answer
A webhook endpoint is an unauthenticated door on the public internet that writes into your core systems, and anyone who learns the URL can knock on it. Everything in the request is attacker-controlled until a signature proves otherwise. The ordered requirements are: verify an HMAC over the raw body in constant time, enforce a timestamp window, deduplicate on event id, cap the body size, and get off the request thread before doing real work.
Was this answer helpful?
Likely follow-ups
- Why must the signature be computed over the raw body rather than the parsed object?
- A partner replays a valid signed request from an hour ago. What stops it?
- Your handler takes four seconds and the partner times out at three. What goes wrong?
- The payload contains an account id. Do you trust it, and what do you check?
- How would you roll a partner's signing secret without downtime?
Related questions
- Walk me through applying STRIDE to the boundary where our order service calls the payments service over the network.mediumAlso on threat-modeling4 min
- A customer's bank shows the money left their account and you have no order. How does your checkout make that impossible, and how do you find the ones that already happened?hardAlso on webhooks6 min
- How do you know when a threat model has gone stale, and how would you catch it before an incident does?mediumAlso on threat-modeling4 min
- You are told the application is safe from injection because all user input is escaped as it comes in. What is wrong with that?mediumAlso on input-validation5 min