Fix Insecure Webhooks in FuelPHP
Webhooks are often the weakest link in your API's perimeter. In FuelPHP, failing to verify the payload signature allows attackers to spoof events, leading to unauthorized state changes or logic bypasses. If your endpoint doesn't validate the source via a cryptographic handshake, it's a wide-open door for exploitation.
The Vulnerable Pattern
class Controller_Webhook extends Controller { public function post_receive() { // VULNERABLE: Direct consumption of POST data without origin verification $data = Input::post(); $order_id = $data['id']; $status = $data['status'];$order = Model_Order::find($order_id); $order->status = $status; $order->save(); return $this->response(['status' => 'success']); }
}
The Secure Implementation
The vulnerability stems from trusting the HTTP POST body implicitly. To secure the webhook: 1. Fetch the raw request body using Input::body() instead of Input::post() to ensure the data hasn't been modified by Fuel's internal sanitization before verification. 2. Retrieve the provider's signature from the headers. 3. Calculate a local HMAC using a shared secret key. 4. Use PHP's hash_equals() for constant-time comparison, which mitigates timing side-channel attacks that could otherwise leak the signature byte-by-byte.
class Controller_Webhook extends Controller { public function post_receive() { $signature = Input::headers('X-Webhook-Signature'); $payload = Input::body(); // Get raw body for hash consistency $secret = \Config::get('app.webhook_secret');if (!$signature || !$payload) { return $this->response(['error' => 'Unauthorized'], 401); } // Compute HMAC-SHA256 using the shared secret $computed = hash_hmac('sha256', $payload, $secret); // Use hash_equals to prevent timing attacks if (!hash_equals($signature, $computed)) { return $this->response(['error' => 'Invalid signature'], 403); } $data = json_decode($payload, true); // Proceed with business logic on verified data... return $this->response(['status' => 'verified']); }
}
Your FuelPHP API
might be exposed to Insecure Webhooks
74% of FuelPHP apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.