T09 · Insecure Skill Coding Practices
Warning
- Location
webhooks.md:57- Finding
Webhook Signature Verification Uses Reserialized JSON and Unsafe Buffer Comparison
- Content
View full analysis
- Remediation
View remediation
` format before comparison. 4. Reject absent, malformed, or incorrectly sized signatures with an HTTP 401 or 403 response. 5. Convert the hexadecimal digest portions to fixed-length byte buffers and confirm equal lengths before calling `timingSafeEqual`. 6. Wrap verification in controlled error handling that always fails closed. 7. Apply request-size limits and endpoint rate limiting. Example hardened implementation: ```javascript const crypto = require('crypto'); function verifySignature(rawBody, signatureHeader) { if ( !Buffer.isBuffer(rawBody) || typeof signatureHeader !== 'string' || !/^sha256=[a-f0-9]{64}$/i.test(signatureHeader) ) { return false; } const suppliedDigest = Buffer.from( signatureHeader.slice('sha256='.length), 'hex' ); const expectedDigest = crypto .createHmac('sha256', process.env.APP_SECRET) .update(rawBody) .digest(); return suppliedDigest.length === expectedDigest.length && crypto.timingSafeEqual(suppliedDigest, expectedDigest); } ``` Configure the web framework to expose `rawBody` before applying a JSON body parser, and do not enqueue or process any webhook until verification succeeds. ]]>