Webhooks are widely used for real-time communication between applications. Companies like Stripe, GitHub, PayPal, Slack, Shopify, Twilio, and Razorpay use webhooks to notify external systems when an event occurs.

Since webhook endpoints are publicly accessible, securing them is critical to prevent spoofing, replay attacks, unauthorized requests, and data tampering.

---

Q1. What is a Webhook?

Answer

A webhook is an HTTP callback where one application automatically sends an HTTP request to another application when a specific event occurs.

Unlike APIs, where clients continuously poll for updates, webhooks push events automatically.

Example

Customer makes payment

↓

Payment Gateway

↓

POST /payment-webhook

↓

Merchant Application

Benefits

• Real-time communication
• Lower network traffic
• Faster event processing
• Event-driven architecture

---

Q2. Why do Webhooks need security?

Answer

Webhook endpoints are usually public.

Without proper security, attackers can:

• Send fake events
• Modify request payloads
• Replay old requests
• Trigger unauthorized actions
• Launch DoS attacks

Production Example

A fake payment webhook could incorrectly mark an unpaid order as "Paid."

---

Q3. How do you authenticate Webhook requests?

Answer

Webhook authentication is commonly implemented using:

• Shared Secret
• HMAC Signature
• API Key
• Mutual TLS (mTLS)
• IP Whitelisting

Recommended Approach

Use HMAC Signature Verification.

Example Request Header

X-Signature:
sha256=ab2345cdef....

The receiver computes the HMAC using the shared secret and compares it with the received signature.

---

Q4. What is HMAC Signature Verification?

Answer

HMAC (Hash-based Message Authentication Code) ensures that:

• The request was sent by a trusted sender.
• The payload has not been modified.

Verification Flow

Webhook Sender
       │
Payload + Secret
       │
Generate HMAC
       │
Send Signature
       │
Receiver
       │
Generate HMAC Again
       │
Compare

If both signatures match, the request is trusted.

---

Q5. What is a Replay Attack?

Answer

A replay attack occurs when an attacker captures a valid webhook request and sends it again later.

Example

Payment Successful

↓

Captured Request

↓

Replay Request

↓

Duplicate Payment Processing

Prevention

• Timestamp validation
• Nonce validation
• Event ID validation
• Duplicate request detection

---

Q6. How do you prevent duplicate webhook processing?

Answer

Every webhook event should contain a unique Event ID.

Example

event_id = evt_12345

Before processing:

• Check whether the Event ID already exists.
• If it exists, ignore the request.
• Otherwise, process it and store the Event ID.

This makes webhook processing idempotent.

---

Q7. Why should HTTPS always be used for Webhooks?

Answer

HTTPS encrypts communication between the sender and receiver.

Without HTTPS:

• Payloads can be intercepted.
• Secrets can be exposed.
• Attackers can modify requests.
• MITM attacks become possible.

Best Practice

Always expose webhook endpoints over HTTPS using valid TLS certificates.

---

Q8. What are the best practices for securing Webhooks?

Answer

Recommended practices:

• HTTPS only
• Verify HMAC signatures
• Validate timestamps
• Reject duplicate Event IDs
• Validate payload schema
• Apply Rate Limiting
• Authenticate every request
• Log webhook events
• Return proper HTTP status codes
• Retry failed events safely

---

Q9. How are Webhooks handled in enterprise applications?

Answer

Webhook requests should never perform heavy processing directly.

Typical flow:

Webhook
     │
Authentication
     │
Validation
     │
Store Event
     │
Message Queue
     │
Background Worker
     │
Business Logic

Benefits

• Faster webhook response
• Better scalability
• Retry support
• Fault tolerance

Most webhook providers expect a quick HTTP 200 OK response.

---

Q10. What are the Webhook Security best practices?

Answer

Follow these best practices:

• Use HTTPS for all webhook endpoints.
• Verify HMAC signatures.
• Never trust incoming payloads.
• Validate timestamps.
• Prevent replay attacks.
• Store processed Event IDs.
• Implement idempotency.
• Apply Rate Limiting.
• Log every webhook request.
• Process events asynchronously using queues.

Production Architecture

               Third-Party Provider
                       │
                  HTTPS Webhook
                       │
                 Load Balancer
                       │
                 API Gateway/WAF
                       │
              HMAC Verification
                       │
             Timestamp Validation
                       │
             Duplicate Event Check
                       │
                Message Queue
                       │
              Background Worker
                       │
              Spring Boot Service
                       │
                  Database

Senior Interview Tip

In enterprise systems, webhook security should be implemented using multiple layers:

• HTTPS
• HMAC Signature Verification
• Timestamp Validation
• Replay Protection
• Idempotency
• Rate Limiting
• Logging & Monitoring
• Queue-based Processing

Never rely on IP Whitelisting alone, as IP ranges may change and additional verification is still required.

---

Quick Revision

• Webhooks are HTTP callbacks.
• Always secure webhooks with HTTPS.
• Use HMAC signatures for authentication.
• Prevent replay attacks using timestamps and Event IDs.
• Implement idempotency.
• Process webhooks asynchronously.
• Return HTTP 200 quickly.
• Validate every payload.
• Apply Rate Limiting.
• Log and monitor all webhook events.