Webhook Signature Forgery Lab
Forge an HMAC-signed webhook without the secret, then flip on signature verification and watch it get rejected.
Forge an HMAC-signed webhook without knowing the secret, then switch verification on properly and watch the same request bounce. This is what a signature actually buys you, demonstrated in both directions.
How to use it
- Send a webhook with verification disabled.
- Observe what the receiver accepts.
- Enable verification and watch the forged request fail.
What to take away
Sign the raw body, verify before parsing
Computing the signature over a re-serialised object rather than the exact received bytes is a common and subtle break.
Compare signatures in constant time
A byte-by-byte early-exit comparison leaks the correct signature through timing. The Timing Attack Visualizer shows exactly how.
Include a timestamp
Without one, a captured valid request can be replayed forever. Reject signatures outside a short window.
Frequently asked questions
Why do webhooks need signatures at all?
The endpoint is public, so anyone can post to it. A signature is the only way to know the request came from the service you expect and was not modified in transit.
Is HTTPS enough on its own?
No. TLS protects the request in transit from third parties; it says nothing about who sent it. Anyone can open their own TLS connection to your endpoint.
Where this fits in the course
This security lab pairs with Path 21 — API Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Timing Attack Visualizer — See exactly why a naive string comparison leaks how many leading characters were correct — and why constant-time comparison fixes it.
- JWT Forgery Lab — Tamper with a JSON Web Token — strip the signature, flip a claim, and watch a vulnerable "verify" endpoint accept it anyway.
- OAuth Redirect URI Hijack Lab — An authorization server validates redirect_uri loosely. Steal an authorization code by redirecting it to your own endpoint.
- Insecure Deserialization Toy — A "remember me" cookie is a trusted, deserialized object. Add one field to grant yourself admin with zero login.