Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteNo. A valid webhook signature can authenticate a delivery and show that its signed payload has not been altered, but it does not decide whether your application should let that event change a particular account, tenant, resource, or record. Verify the signature first; then apply your own authorization rules before performing the requested action.
What webhook signature verification proves
For GitHub webhooks, the X-Hub-Signature-256 header contains an HMAC-SHA256 digest of the request body, calculated with the webhook secret. Recalculate the digest from the exact body bytes your server received, then compare it with the header using a constant-time comparison. GitHub warns against an ordinary == comparison and against allowing a proxy or load balancer to modify the payload before verification. See GitHub’s webhook signature validation guidance.
A successful check means the body matches a message made with the configured secret and has remained intact. It does not prove that the event is fresh, has not been delivered before, or is permitted to trigger a particular effect in your system. The secret must also be stored and handled securely; anyone who obtains it may be able to create a valid signature.
Authentication and authorization answer different questions
| Check | Question it answers | Who defines the decision? |
|---|---|---|
| Signature validation | Does this payload match one signed with the configured sender secret, and has the signed body remained intact? | The provider’s signing scheme and your correct implementation of it. |
| Authorization | May this event perform this operation on this resource for this tenant or account under current policy? | Your receiving application. |
A correctly signed event may still refer to an unexpected tenant, a resource your service does not control, or an operation that your current policy forbids. Treat the signature as an authentication and integrity check—not as a grant of permission.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
Process a delivery in separate security steps
- Verify authenticity and integrity. For GitHub, use the configured secret, the original unmodified request body, and
X-Hub-Signature-256. Reject a missing or invalid signature before acting on the payload. The olderX-Hub-Signatureheader uses HMAC-SHA1 and is retained for compatibility; do not accept a header merely because it is present. Recompute and compare using the appropriate configured scheme. See GitHub’s event and payload documentation. - Detect duplicates and replays. Use the delivery identifier to recognize deliveries you have already handled, and make side effects safe to retry. GitHub documents
X-GitHub-Deliveryas unique per event; a redelivery retains the original identifier. A valid signature alone does not establish freshness or uniqueness. See GitHub’s webhook best practices. - Check the event type and action. Confirm that the event and action are ones your receiver expects. GitHub specifically advises checking these before processing; provider-specific headers and event conventions should not be assumed to apply to other services.
- Authorize the requested effect. Resolve the affected resource and its account or tenant, then evaluate whether your application policy permits this operation in the current state. This is your system’s decision, not a permission conveyed by signature verification.
- Perform the effect safely. Make processing idempotent so a retry or redelivery does not apply the same side effect twice. Record processing state in a way that supports reliable retry and duplicate detection.
Keep the HTTP response path quick
GitHub recommends responding with a 2XX status within 10 seconds; the documentation does not state a year for this operational target. If authorization checks or downstream work may take longer, acknowledge promptly after safely accepting the delivery for processing and move the work to a queue. Do not acknowledge work that has not been durably accepted if doing so would cause it to be lost. GitHub discusses queues and names Hookdeck as one service example; this is an implementation option, not a requirement. See GitHub’s webhook best practices.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apply provider-specific rules carefully
The details above about X-Hub-Signature-256, X-Hub-Signature, and X-GitHub-Delivery are specific to GitHub. For another provider, check its current documentation for the signature algorithm and header, access to the original body, secret handling or rotation guidance, replay identifiers, and retry or redelivery behavior. Keep the same architectural boundary: authenticate and validate the delivery, then make an independent authorization decision before changing protected application data.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
