Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Test webhook signature verification with a known-good, provider-supported payload and signature, then change the payload without changing its signature. The first request should pass verification; the altered request, a bad signature, a missing signature, and a request signed with the wrong secret should fail before business logic runs. Verify the exact raw request body before parsing or transforming it, and compare signature values in constant time.
Build a test matrix before testing the handler
Keep the valid case as a positive control: it shows that the handler accepts the provider’s expected signing format. The negative cases check that it rejects altered or incomplete authentication material.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
APIs and Webhooks for Beginners: Connect Apps, Automate Tasks, and Build Useful Integrations | $2.99 | Buy on Amazon |
| 2 |
|
Shelly Pro 3EM 3CT 63 Wi-Fi & LAN 3-Phase Smart Energy Meter | $150.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
| Test | Fixture | Expected result |
|---|---|---|
| Valid signature | Exact known payload, correct secret, and provider-formatted signature header | Verification passes and handler logic continues. |
| Tampered body | Change one byte or character in the body but retain the original signature | Reject before business processing. |
| Tampered signature | Keep the body and secret; change one character in the signature | Reject. |
| Missing signature | Omit the required signature header | Reject. |
| Wrong secret | Use the correct body and header with a different configured secret | Reject. |
| Body normalization | Alter whitespace, key order, or encoding before verification | The altered input should not verify; the handler must preserve the original body for valid requests. |
| Provider mismatch | Use another provider’s header, algorithm, or secret | Reject. |
Use separate assertions for verification and business processing. A request that fails signature verification should not trigger the event’s ordinary side effects.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRun a deterministic valid-signature test
GitHub publishes a ready-to-use test vector: secret It's a Secret to Everybody, payload Hello, World!, and expected HMAC-SHA256 hex digest 757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17. The corresponding header value is sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17. Use this as a fixed test fixture, not as a production secret. See GitHub’s validation example.
#1 Best Overall
- Pass the exact payload bytes and the test secret to an HMAC-SHA256 implementation.
- Format the digest as lowercase hexadecimal and prepend
sha256=, matching GitHub’sX-Hub-Signature-256header format. - Verify the computed value against the supplied header using a constant-time comparison.
- Assert that the valid fixture passes, then reuse its original signature for the negative tests.
Test tampering and malformed authentication material
For the primary tampering check, alter only the body and retain the original signature. Even a one-character change should cause verification to fail because the supplied signature was calculated over different content. Separately change one character in the signature while leaving the body and secret untouched.
Also submit a valid-looking body with the required header omitted, a malformed signature value, and a signature paired with the wrong secret. These cases catch code paths that might accept missing data, parse an unexpected format leniently, or use the wrong endpoint configuration.
For a body-normalization regression test, start with the valid payload and introduce whitespace, key-order, or encoding changes before verification. The transformed body must not be treated as the original signed content. A stronger positive-path assertion is to deliver the original bytes through the real request-handling path and confirm they remain unchanged up to the verifier.
Verify the raw body before parsing or middleware changes it
Webhook signatures are calculated over provider-defined input, commonly the request body in its original form. Parsing JSON and serializing it again can change whitespace, key order, or encoding; semantically equivalent JSON is not necessarily the same signed input. Keep the original request body intact until verification succeeds, then parse it for application use.
Stripe
Stripe’s event construction and verification flow takes three values: the request body string sent by Stripe, the Stripe-Signature header, and the endpoint secret. Use the secret associated with the event’s source: a Dashboard endpoint secret differs from the secret printed by stripe listen. Stripe requires the UTF-8 request body string without changes. In Express, its Node integration guidance says to put express.json() after the webhook route. See Stripe’s signature troubleshooting guidance.
GitHub
GitHub’s current header for this purpose is X-Hub-Signature-256, containing an HMAC-SHA256 hex digest prefixed with sha256=. GitHub documents the older X-Hub-Signature as HMAC-SHA1 for legacy use; use the SHA-256 header for current verification. Its example uses the original request body and notes UTF-8 handling where the language or framework requires encoding. See GitHub’s validation guidance.
Rank #2
- The Shelly Pro 3EM 3CT 63 is a next-gen DIN rail-mountable energy meter for single or three-phase installations, featuring a 63A, 3-phase current transformer for non-contact measurements. It supports 4-quadrant measurement, optical pulse indication of energy usage, and is photovoltaic-ready. *It doesn't have a built-in relay; contactor control requires a Shelly Pro Addon attached to the device.
- Professional Smart Meter - Shelly Pro 3EM-3CT63 is a professional smart meter that reports accumulated energy, voltage, current, active, and apparent power per phase in real time. It stores data for up to 60 days in 1-minute intervals and includes a real-time clock to maintain accurate time if the SNTP server connection is lost.
- Ideal for business energy measurement - In commercial buildings, it helps monitor energy usage across floors or departments allowing accurate cost allocation and identification of energy wastage. In manufacturing plants it tracks energy consumption of heavy machinery, optimizing usage to reduce operational costs. For store owners it monitors energy usage of systems like lighting, HVAC § refrigeration, helping to identify inefficiencies § reduce energy bills while supporting sustainable practices
- Shelly Customer Service - Shelly is one of the fastest-growing Smart Home brands in the world with devices, providing solutions for the automation of private homes, buildings and businesses. We provide our customers with professional support and a 5 years device warranty.
- Shelly Smart Control App will help you control your Shelly devices remotely and will send notifications for all automated events in your home. You can easily configure devices and manage their settings individually, or you can create personalized scenes by combining Shelly devices to trigger certain actions in your home automation.
Compare signatures safely
After calculating the expected signature with the correct algorithm, secret, and input, compare it to the supplied signature using a constant-time comparison function. GitHub explicitly warns: “Never use a plain == operator.” Its documentation gives examples such as secure_compare, crypto.timingSafeEqual, and Python’s hmac.compare_digest. Use the equivalent primitive recommended for your language rather than an ordinary string equality check. See GitHub’s comparison examples.
Protect secrets and handle replay separately
Store webhook secrets securely, generate high-entropy values, and do not hardcode them in application code or commit them to a repository. For live endpoints, use HTTPS and leave SSL verification enabled. GitHub’s webhook best practices also recommend these precautions.
A valid signature proves authenticity and body integrity under the provider’s signing scheme; it does not, by itself, prevent replay of a previously valid delivery. GitHub recommends using X-GitHub-Delivery to identify repeated deliveries. Account for the fact that an explicitly requested redelivery retains the original delivery ID, so deduplication should not accidentally treat a legitimate redelivery as a new event.
GitHub recommends returning a 2XX response within 10 seconds. If processing may take longer, acknowledge promptly and move work to asynchronous processing; GitHub names services such as Hookdeck as examples in its guidance.
What changes when you support multiple providers?
Do not share verification assumptions across providers. For each integration, document and test its own:
- Signature header name and syntax.
- Algorithm and exact signed input, including any timestamp or other fields.
- Encoding and raw-body requirements.
- Secret source, endpoint association, and rotation process.
- Official SDK verification behavior.
- Freshness checks and delivery-ID or replay handling.
GitHub’s cited guidance covers body-based HMAC-SHA256 and a delivery identifier; Stripe’s covers Stripe-Signature, an endpoint-specific secret, and unchanged request-body handling. Those examples are not a complete provider matrix. Check each additional provider’s current official documentation and build its fixtures from that specification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
