Fix Insecure Webhooks in Gorilla

Webhooks without signature verification are an open invitation for attackers to inject arbitrary data into your internal systems. If your Gorilla/mux endpoint processes payloads without validating an HMAC signature, you're vulnerable to request forgery. An attacker can spoof events, bypass business logic, or trigger unauthorized state changes. Stop trusting the 'Source' header and start verifying the payload integrity.

The Vulnerable Pattern

func InsecureHandler(w http.ResponseWriter, r *http.Request) {
	var payload map[string]interface{}
	// VULNERABILITY: Blindly trusting the body content without verification
	if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
		http.Error(w, "Bad Request", 400)
		return
	}
	ExecuteAction(payload["action"])
	w.WriteHeader(http.StatusOK)
}

The Secure Implementation

The secure implementation enforces three critical security layers. First, it extracts a pre-shared secret from the environment. Second, it calculates the HMAC-SHA256 hash of the raw request body. Third, it uses hmac.Equal() for the comparison. This is vital because it performs a constant-time check, neutralizing timing side-channel attacks that could allow an attacker to brute-force the signature byte-by-byte. By verifying the signature before any business logic is executed, you ensure the authenticity and integrity of the webhook event.

func SecureHandler(w http.ResponseWriter, r *http.Request) {
	secret := []byte(os.Getenv("WEBHOOK_SECRET"))
	signature := r.Header.Get("X-Hub-Signature-256")
body, err := io.ReadAll(r.Body)
if err != nil {
	http.Error(w, "Read Error", 500)
	return
}

// Re-wrap body for later decoding
r.Body = io.NopCloser(bytes.NewBuffer(body))

mac := hmac.New(sha256.New, secret)
mac.Write(body)
expectedMAC := "sha256=" + hex.EncodeToString(mac.Sum(nil))

// Use constant-time comparison to prevent timing attacks
if !hmac.Equal([]byte(signature), []byte(expectedMAC)) {
	http.Error(w, "Forbidden", http.StatusForbidden)
	return
}

// Proceed with JSON decoding...
}