Summary
Right now webhook has no cryptographic verification method to ensure the approvals poster is the same entity that initiated the call.
This is not prescriptive but a brief summary of industry standards:
Primary Standard
• HMAC-SHA256 Signatures: The sender signs the HTTP payload with a shared secret. The receiver hashes the incoming payload with the same secret and verifies the signature (e.g., GitHub's X-Hub-Signature-256 or Stripe's Stripe-Signature).
• Timestamping: The header includes a timestamp hashed into the signature to prevent replay attacks (reject requests older than ~5 minutes).
Additional Context
No response
Upload screenshots
No response
Searched Issues
Code of Conduct
Summary
Right now webhook has no cryptographic verification method to ensure the approvals poster is the same entity that initiated the call.
This is not prescriptive but a brief summary of industry standards:
Additional Context
No response
Upload screenshots
No response
Searched Issues
Code of Conduct