course prep arena ask shorts stories you ?

0 / 100 xp → junior

~course prep arena ask shorts stories you

Loading page…

~/himanshutty1

~/himanshu$cd ~/next-page

[ok]resolve route

[..]stream page

← all concepts

HMAC signature.

also: HMAC · HMAC-SHA256 · HMAC signatures · webhook signature · replay attack · replay attacks

A hash of the payload keyed with a shared secret, sent with a webhook so the receiver can check it is authentic and untampered.

the two-minute refresher

Sender: signature = HMAC-SHA256(secret, timestamp + raw body), sent in a header.
Receiver recomputes it over the exact raw bytes and compares in constant time.
Sign and send the same bytes: re-serialising JSON changes spacing and breaks the match.
Include a timestamp and reject old messages, or attackers can replay them.

Where the course teaches it

W02 · Day 4Webhook Delivery Systemlearn it →W02 · Day 4Webhook Delivery Systemrevisit →W02 · Day 4Webhook Delivery Systemrevisit →

Related concepts

Webhook