Insecure webhooks are a prime target for state-manipulation and logic bypass. In Roda, if you process incoming POST requests from third-party services (like Stripe or GitHub) without cryptographic verification, an attacker can spoof payloads to trigger unauthorized actions, such as marking unpaid orders as 'paid'. To secure this, you must implement HMAC-SHA256 signature validation using a shared secret.

The Vulnerable Pattern

class App < Roda
  route do |r|
    r.post "webhooks/status-update" do
      # VULNERABLE: No signature verification
      payload = JSON.parse(r.body.read)
      User.find(payload['user_id']).update(premium: true)
      "OK"
    end
  end
end

The Secure Implementation

The secure implementation introduces three layers of defense. First, it captures the raw request body for hashing, as whitespace changes in parsed JSON will break signatures. Second, it uses OpenSSL::HMAC with SHA256 and a shared secret to generate a local fingerprint of the payload. Third, it employs Rack::Utils.secure_compare for the string comparison. This is critical to prevent timing attacks where an attacker could brute-force the signature by measuring the microsecond differences in how long a standard '==' comparison takes to fail.

require 'openssl'
require 'rack/utils'
class App < Roda
Load your secret from a secure environment variable
WEBHOOK_SECRET = ENV.fetch(‘WEBHOOK_SIGNING_SECRET’)
route do |r|
r.post “webhooks/status-update” do
signature = r.env[‘HTTP_X_HUB_SIGNATURE_256’]
payload_body = r.body.read
  # SECURE: Compute HMAC and use constant-time comparison
  expected_sig = 'sha256=' + OpenSSL::HMAC.hexdigest('sha256', WEBHOOK_SECRET, payload_body)

  if signature.nil? || !Rack::Utils.secure_compare(signature, expected_sig)
    r.halt 403, "Unauthorized: Signature Mismatch"
  end

  data = JSON.parse(payload_body)
  User.find(data['user_id']).update(premium: true)
  "OK"
end
end
end