Securing Webhooks Between Netlify and a Home Automation Server

Описание и применение

Вебхуки от Netlify защищены подписью HMAC и таймстампом, предотвращая спам и повторные атаки.

Задача

Random webhook spam and replay attacks were flooding the home‑automation server, risking unintended routines.

Результат

Webhook traffic is now authenticated and replay‑protected, eliminating spam and unintended triggers.

Рабочий процесс

• Generate HMAC signature and timestamp in Netlify Function before sending POST to home server
• Attach X‑Signature and X‑Timestamp headers
• Home server receives request, checks for missing headers
• Validate timestamp is within five minutes
• Recalculate HMAC with shared secret and compare using crypto.timingSafeEqual
• If both checks pass, execute business logic; otherwise respond with 401

Доказательства

When a user triggers an action on the site, a Netlify Function prepares the payload. Before sending it to my home server’s dynamic DNS endpoint, the function generates a cryptographic signature using a shared secret key stored in Netlify's environment variables.

Источник

First, it checks if the timestamp is older than five minutes. If it is, the request is dropped immediately.

Источник

Second, it recalculates the HMAC using the shared secret and compares it against the incoming X‑Signature header using crypto.timingSafeEqual to prevent timing attacks.

Источник