core practice · coding problem
Verify webhook HMAC
Body b, secret s, header HMAC-SHA256(s,b). Constant-time compare. Why reject if timestamp >5m old?
The mechanism
A webhook is the provider calling your server when something happens, instead of your server polling them. Three rules: verify the signature so you trust the sender, return 200 fast and queue the actual work, and assume the same event may be delivered more than once.
Expected evidence
Prevents replay; timing-safe compare prevents forgery leaks.
Try this drill in the practice workspace →
Hints when you need them
- Sign raw body bytes.
- Include timestamp in signed payload.