Fix Insecure Webhooks in Lumen
Webhooks are a massive attack vector if you're just blindly trusting POST bodies. In Lumen, if you don't verify the HMAC signature, you're leaving your application wide open to unauthorized state changes and logic bypasses. Attackers can simply spoof the payload and trigger sensitive actions like payment confirmations or user escalations. Let's harden the endpoint.
The Vulnerable Pattern
public function handle(Request $request) {
// VULNERABLE: No source verification or integrity check.
// An attacker can POST any JSON to this route.
$data = $request->all();
$order = Order::find($data['order_id']);
$order->update(['status' => 'paid']);
return response()->json(['status' => 'success']);
}The Secure Implementation
The vulnerable snippet assumes the request is legitimate because it hit the endpoint. The fix implements a Shared Secret pattern. 1) We extract the raw payload using getContent()—never use $request->all() for verification as it may be mutated by middleware. 2) We calculate a SHA256 HMAC. 3) We use hash_equals() for a constant-time comparison, mitigating side-channel timing attacks that could leak the secret. Only after the signature is verified do we process the business logic.
public function handle(Request $request) { $signature = $request->header('X-Webhook-Signature'); $payload = $request->getContent(); $secret = env('WEBHOOK_SECRET');if (!$signature || !$secret) { return response()->json(['error' => 'Missing signature or secret'], 401); } // Compute HMAC using the raw body and the shared secret $computedSignature = hash_hmac('sha256', $payload, $secret); // Use hash_equals to prevent timing attacks if (!hash_equals($computedSignature, $signature)) { return response()->json(['error' => 'Invalid signature'], 403); } $data = json_decode($payload, true); $order = Order::findOrFail($data['order_id']); $order->update(['status' => 'paid']); return response()->json(['status' => 'verified']);
}
Your Lumen API
might be exposed to Insecure Webhooks
74% of Lumen apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.