Verify cryptographic HMAC signatures on all inbound carrier webhooks and enforce 5-minute timestamp tolerance windows to prevent replay exploits.
Because webhooks are exposed public endpoints, attackers can intercept and re-transmit previously valid payloads to forge incoming SMS messages. Implementing HMAC-SHA256 signature verification and timestamp validation is essential for production security.
1 HMAC-SHA256 Verification Protocol
1. Carrier signs request: Aggregator computes HMAC-SHA256 hash using your shared secret over the full request URL and POST parameters.
2. Server recalculates hash: Ingest the raw request body, compute HMAC-SHA256 using the vaulted secret, and compare using timing-safe comparisons.
3. Timestamp Tolerance: Verify that the X-Webhook-Timestamp is within +/- 300 seconds of current server time to prevent replay attacks.
Frequently Asked Questions • QA Automation & Testing
Standard string equality (==) returns false on the first mismatched byte, creating timing side-channel vulnerabilities. Use crypto.timingSafeEqual or hmac.compare_digest.