Validating Webhook Signatures and Replay Windows

Verify a raw webhook body with HMAC and bound timestamp before processing. The examples separate the essential operation from the conditions a production implementation must enforce.

What It Does

Verify a raw webhook body with HMAC and bound timestamp before processing.

Prerequisites

Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.

Example 1: Core Behavior

The first example isolates the core operation so its result is easy to understand.

<?php
$secret = 'demonstration-only-secret';
$body = '{"event":"updated"}';
$signature = hash_hmac('sha256', $body, $secret);
echo hash_equals(hash_hmac('sha256', $body, $secret), $signature) ? 'Verified' : 'Rejected';

Example 2: Alternative or Failure Case

The second example demonstrates an alternative outcome, rule or failure condition.

<?php
$body = '{"id":"evt_12"}'; $key = 'demonstration-only-secret';
$received = str_repeat('0',64);
$valid = hash_equals(hash_hmac('sha256', $body, $key), $received);
http_response_code($valid ? 204 : 401);

Practical Example: Applying the Rule

The practical example shows how to carry the same constraint into application code.

<?php
$timestamp = time() - 900; $window = 300;
$fresh = abs(time() - $timestamp) <= $window;
echo $fresh ? 'Timestamp accepted' : 'Stale delivery rejected';

Important Behavior and Edge Cases

Check a bounded timestamp window and a persistent event ID to stop both stale and repeated valid deliveries.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Verify a raw webhook body with HMAC and bound timestamp before processing.
• Check a bounded timestamp window and a persistent event ID to stop both stale and repeated valid deliveries.
• TLS secures the connection but does not replace end-to-end message authentication.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.