Securing Webhooks Between Netlify and a Home Automation Server

Description and use

Webhooks from Netlify are secured with an HMAC signature and timestamp, preventing spam and replay attacks.

Problem

Random webhook spam and replay attacks were flooding the home‑automation server, risking unintended routines.

Outcome

Webhook traffic is now authenticated and replay‑protected, eliminating spam and unintended triggers.

Workflow

• Generate HMAC signature and timestamp in Netlify Function before sending POST to home server
• Attach X‑Signature and X‑Timestamp headers
• Home server receives request, checks for missing headers
• Validate timestamp is within five minutes
• Recalculate HMAC with shared secret and compare using crypto.timingSafeEqual
• If both checks pass, execute business logic; otherwise respond with 401

Evidence

When a user triggers an action on the site, a Netlify Function prepares the payload. Before sending it to my home server’s dynamic DNS endpoint, the function generates a cryptographic signature using a shared secret key stored in Netlify's environment variables.

Source

First, it checks if the timestamp is older than five minutes. If it is, the request is dropped immediately.

Source

Second, it recalculates the HMAC using the shared secret and compares it against the incoming X‑Signature header using crypto.timingSafeEqual to prevent timing attacks.

Source