Receiving webhooks without getting burned

Short summary

A practical guide to building robust webhook receivers, covering signature verification with timing-safe comparison, raw body parsing, replay attack prevention via timestamps, and handling out-of-order or retried deliveries. Uses email bounce webhooks as a running example but applies to Stripe, GitHub, Shopify, and any provider. Includes TypeScript/Node.js code snippets for Express and Next.js.

• •Verify signatures with timingSafeEqual on raw body bytes, not parsed JSON
• •Check timestamps to prevent replay attacks with clock-skew tolerance
• •Exempt webhook routes from body-parsing middleware to preserve raw bytes for verification

Generated with AI, which can make mistakes.