Group
  • Security

    Verify incoming webhooks are genuine

    Adds signature verification to every inbound webhook so forged events can't trigger actions.

    • Improve quality
    • Debug & fix
    • Intermediate
    • General

Free Prompt

Audit every inbound webhook endpoint in my app (payment providers, email services, third-party integrations). For each one, verify that the endpoint authenticates the sender before acting on the payload. Apply the provider's official verification mechanism: signature header validation using the signing secret (Stripe, Shopify, GitHub, and most serious providers sign their webhooks), using the raw request body exactly as received (do not parse and re-serialize the JSON before verifying, it changes the bytes and breaks the signature). Where a provider offers no signatures, fall back to a secret path segment or a shared token header, and note the weaker guarantee. Reject invalid signatures with a 401 and log the attempt. Also check timestamp tolerance if the provider includes one, so old captured requests can't be replayed. Do not change what the webhooks do after verification. Do not expose the signing secrets in client-side code or logs. Make sure the raw-body requirement doesn't break other middleware ordering. For each webhook, show me the verification added. Give me a test: send a forged request with a bad signature and confirm rejection, then a properly signed test event (most providers have a CLI or dashboard tool for this) and confirm it processes.

What This Does / How This Helps

Makes every webhook endpoint prove the sender is who it claims to be before acting, using the provider's signature scheme. An unverified webhook is an open door. If your payment-success webhook trusts whatever JSON arrives, anyone who finds the URL can mark their own orders paid, extend their subscription, or trigger refunds. Signature verification is a few lines and it's the only thing standing between your order state and the open internet. The raw-body detail is included because it's the classic implementation trap: parse the body first and the signature check fails against the re-serialized bytes forever.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts