Netradyne can sign the Webhook events that it sends to client endpoints by including a signature in each event's Netradyne-Signature header. This allows users to verify that the events were sent by Netradyne and not by a third party. Users can verify signatures by using their own solution based on the algorithm mentioned here.
Preventing Replay Attacks
A replay attack occurs when an attacker intercepts a valid payload and its signature, and then re-transmits them. To mitigate such attacks, Netradyne includes a timestamp in the "Netradyne-Signature" header. Because this timestamp is part of the signed payload, it is also verified by the signature so an attacker cannot change the timestamp without invalidating the signature. If the signature is valid but the timestamp is too old, you can have your application reject the payload. Netradyne generates the timestamp and signature each time an event is sent to your endpoint. If Netradyne retries an event (for example, your endpoint previously replied with a non-2xx status code), then a new signature and date are generated for the new delivery attempt.
Example:
Netradyne-Signature:
Extract the timestamp and signatures from the Netradyne-Signature header:
Split the header using character as separator to get a list of elements. Then split each element using the = character as the separator to get a prefix and value pair. The value for the prefix timestamp corresponds to the timestamp and hmac corresponds to the signature.
Netradyne's Algorithm
Step1: Prepare the signed_payload string.
Step2: Use the HMAC algorithm to create a signature based on a shared secret.
Step3: After calculating the HMAC value, it must be sent to the server. This is done by providing a custom header.
Step 4: Compare the signatures.
Verify the events that Netradyne sends to your Webhook endpoints.