Snippet

Webhook HMAC Signature Verification in Django Request Handlers

Validating incoming webhook payloads using HMAC digests ensures data authenticity and prevents tampering. By comparing hashes using constant-time comparison, request handlers protect against timing attacks while validating requests before processing business logic.

snippet.py

python

import hmac
import hashlib
from django.conf import settings
from django.http import HttpResponseForbidden, JsonResponse
 
def verify_webhook_signature(request):
    signature = request.headers.get('X-Signature-256')
    if not signature:
        return HttpResponseForbidden('Missing signature header')
    expected_hash = hmac.new(
        settings.WEBHOOK_SECRET.encode(),
        request.body,
        hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(signature, expected_hash):
        return HttpResponseForbidden('Invalid payload signature')
    return JsonResponse({'status': 'verified'})

django

Breakdown

signature = request.headers.get('X-Signature-256')

Extracts the cryptographic signature header sent by the external webhook provider.

expected_hash = hmac.new(settings.WEBHOOK_SECRET.encode(), request.body, hashlib.sha256).hexdigest()

Computes an SHA-256 HMAC hash using the secret key and the raw request payload bytes.

if not hmac.compare_digest(signature, expected_hash):

Uses a constant-time comparison algorithm to safely match signatures without exposing timing side-channels.

Previous snippet Next snippet

More Intermediate Python exercises →

Webhook HMAC Signature Verification in Django Request Handlers

Related