What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify a webhook’s signature against the exact request body before you trust or process its payload. The details are provider-specific: GitHub, Shopify, Slack and Stripe differ in header names, signed input, digest encoding and timestamp handling. Parse the body only after verification, use a constant-time comparison, and handle freshness and duplicate deliveries separately.
What webhook signature verification proves—and what it does not
The sender and your application use a configured secret to produce and check a message authentication value. Your server computes the expected value from the provider-defined input and compares it with the value sent in a header. A valid signature supports the conclusion that the message matches content signed by someone with the configured secret; GitHub describes validation as checking that a delivery came from GitHub and was not tampered with. GitHub’s validation guide and Shopify’s verification guide both say to verify before trusting or further processing payload contents.
As an Amazon Associate I earn from qualifying purchases.
A valid signature does not, by itself, prove that a request is fresh, has never been received before, or is safe to execute. Freshness checks and idempotent processing address different risks and are available in provider-specific ways.
Why the raw request body matters
The signed input is often the original body bytes or a provider-defined string built from them. Parsing JSON and serializing it again can change whitespace, key order, escaping or encoding even when the resulting object appears equivalent. That changes the bytes being authenticated and can cause a legitimate delivery to fail verification.
GitHub’s examples verify the request body before parsing JSON. Shopify warns that body-parsing middleware must not run first; Slack says to use the raw body before deserialization; Stripe lists changes to whitespace, object-key order, JSON serialization or encoding among causes of verification failure. See the providers’ guidance: GitHub, Shopify, Slack and Stripe.
In an Express-style application, capture the webhook body in its original form before general JSON middleware consumes it, or use the provider’s supported integration library. Stripe specifically cautions that putting express.json() before the webhook route can parse the body too early. Shopify’s manual example uses raw middleware. Do not verify a pretty-printed or reconstructed JSON object in place of the received body.
Rank #2
Put verification in the request pipeline
- Capture the original body. Preserve the received bytes or the raw string required by the provider before parsing or transforming it.
- Read the verification metadata. Obtain the signature header and, where applicable, the timestamp or delivery identifier.
- Select the correct secret. Use the secret configured for the specific provider endpoint, app or event source.
- Compute the expected signature exactly as documented. Match the signed input, algorithm and output encoding; do not assume every provider signs “the JSON.”
- Compare safely. Validate that required headers are present and well formed, then use a constant-time comparison rather than ordinary string equality.
- Reject a mismatch before parsing or processing. Parse and act on the payload only after verification succeeds.
- Apply separate safeguards where supported. Check timestamp freshness and make event handling idempotent or deduplicate deliveries as appropriate.
This is a practical ordering, not a universal code sample: provider SDKs and formats differ. Use the provider’s current instructions for the actual endpoint.
Recommended Free Tools
How the major providers differ
| Provider | Header and signed input | Format or additional control |
|---|---|---|
| GitHub | X-Hub-Signature-256; HMAC-SHA256 over the payload contents |
Hex digest prefixed with sha256=. Handle UTF-8 correctly. GitHub identifies X-Hub-Signature, which uses SHA-1, as legacy. |
| Shopify | X-Shopify-Hmac-SHA256; HMAC-SHA256 over the raw request body for HTTPS deliveries |
Base64-encoded digest. Shopify says this HMAC verification applies to HTTPS deliveries; Google Cloud Pub/Sub and Amazon EventBridge do not require it. Delivery IDs and idempotency address duplicate handling. |
| Slack | X-Slack-Signature; HMAC-SHA256 over a versioned base string formed from v0, the timestamp and the raw request body |
The signature uses v0= followed by a hex digest. Slack documents checking timestamp recency and gives a five-minute example window. |
| Stripe | Stripe-Signature; use Stripe’s SDK event construction or verification function with the request body, signature header and endpoint secret |
The documented header shape includes timestamp and signature components such as t=..., v1=... and v0=.... The correct endpoint secret and unchanged body matter. |
These recipes are not interchangeable. Consult the official instructions for each integration: GitHub, Shopify, Slack and Stripe.
Diagnose a signature failure
Check that the secret belongs to this endpoint
For GitHub, confirm that a secret is configured for the webhook and that the receiver uses that webhook’s secret; GitHub says the signature header is absent when no secret is configured. Stripe’s Dashboard endpoint secret and Stripe CLI forwarding secret are different, so use the secret for the event’s source. Shopify notes that after a client-secret rotation, it can take up to one hour before new-secret HMAC digests are generated. Do not treat that provider-specific transition period as a general rule.
Check the header, algorithm and encoding
Use GitHub’s recommended X-Hub-Signature-256 HMAC-SHA256 header rather than relying on its legacy SHA-1 header. Preserve each provider’s expected representation: GitHub uses a prefixed hexadecimal digest, while Shopify uses Base64. Verify the exact header and parsing rules for the provider rather than converting values by guesswork.
Check for body transformations and intermediary changes
Confirm that middleware has not parsed or reserialized the body before verification. Check the actual raw representation received by the webhook handler, not a regenerated object. Stripe calls out whitespace, key ordering, serialization and encoding changes; Shopify flags middleware ordering and raw-body capture. GitHub also warns that proxies or load balancers must not modify the body or headers.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check malformed or missing inputs and comparison method
Reject missing or malformed signature headers before comparing. Use the provider’s supported library or a constant-time comparison helper: GitHub’s Python example uses hmac.compare_digest and warns, “Never use a plain == operator.” Shopify’s Node.js example uses crypto.timingSafeEqual, and Slack recommends an HMAC comparison function. Keep the expected digest’s encoding and length rules intact.
Handle replay and duplicate deliveries separately
Freshness and replay
A signed timestamp lets a receiver limit the useful lifetime of a captured request when the provider’s format supports it. Slack’s signature incorporates the timestamp; its documentation gives an example that rejects requests whose timestamp differs from local time by more than five minutes. That is Slack’s example policy, not a universal webhook standard. Follow the provider’s current policy and keep the server clock synchronized. The cited GitHub validation guidance does not specify a signed timestamp or replay window, so GitHub signature verification alone should not be described as providing Slack’s timestamp-based control.
Retries and duplicate processing
A sender may deliver an event again after a timeout or retry, even when each delivery has a valid signature. Shopify recommends idempotent processing and documents two useful identifiers: X-Shopify-Webhook-Id identifies an individual delivery, while X-Shopify-Event-Id can correlate separate subscriptions arising from one merchant action. Do not treat separate subscriptions as the same delivery merely because they share an event ID. Store and check the identifier that matches the duplicate-handling policy you need.
Protect signing secrets
A signature check is only as trustworthy as the secret selection and storage behind it. GitHub recommends a high-entropy secret, secure storage, and avoiding hardcoding or committing it. Shopify, Slack and Stripe likewise rely on app- or endpoint-specific secrets. Use environment-backed or managed secret storage appropriate to your deployment; keep working secrets out of source examples, logs and error responses. Follow the relevant provider documentation for setup and rotation: GitHub, Shopify, Slack and Stripe.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
