Building a Hardened Webhook Ingestion Engine: Preventing Replay Attacks, Timing Side-Channels, and Why Our Automation Blew Up on Line 1

说明与用途

构建了一个安全的 webhook 接收引擎，包含头部验证、JSON 反序列化、常量时间 HMAC 验证、时间漂移检查和幂等性过滤，防止篡改、重放、时序攻击和竞争条件。

问题

Webhook endpoints are vulnerable to payload tampering, replay attacks, timing attacks, and idempotency race conditions when lacking strict defensive programming.

结果

The hardened engine rejects malformed, tampered, or replayed webhooks with appropriate HTTP status codes (400, 401, 403, 409) and ensures each valid request is processed exactly once.

工作流

• Receive HTTP POST with raw headers and body
• Validate headers via Pydantic v2
• Deserialize JSON from raw bytes with orjson and Pydantic v2
• Verify HMAC‑SHA256 signature using hmac.compare_digest
• Check timestamp drift against max_drift_seconds
• Check idempotency via MockRedisStore.is_duplicated
• Execute core business logic if all gates pass

证据

Payload tampering and spoofing via missing or weak signature validation.

来源

HMAC-SHA256 Signature Check (Constant-time compare_digest)

来源

MockRedisStore.is_duplicated registers new ID with expiration timestamp

来源