What Is a Webhook Signature?
A webhook signature is a hash sent alongside a webhook payload, computed from the payload and a shared secret. The receiver recomputes it and compares. If the two match, the payload came from someone holding the secret and has not been altered in transit.
Without one, a webhook endpoint is a public URL that accepts instructions from anyone who finds it. Anyone can post a fake submission, a fake payment or a fake cancellation, and your system has no way to tell.
Two mistakes make signature checks decorative. The first is verifying against a re-serialised body: if you parse the JSON and then re-encode it before hashing, key order and whitespace change and the signature never matches, so people disable the check to ship. Always hash the exact bytes you received.
The second is comparing with ==. A normal string comparison returns as soon as two characters differ, and the time it took leaks how much of the signature was correct. Given enough attempts that is enough to forge one. Use a constant-time comparison, which every language has for this purpose.
Include a timestamp in what you sign and reject anything older than a few minutes. Otherwise a valid signed request captured once can be replayed forever.
In WebForms
WebForms signs webhook deliveries with HMAC-SHA256 over the raw body plus a timestamp, so a captured payload cannot be replayed later.