Webhook Security

Learn how to secure your webhook implementation and verify webhook authenticity.

Signature Verification

MangoForm signs webhook payloads with a secret key using HMAC-SHA256. You should verify this signature to ensure the webhook is legitimate.

// Example signature verification in Node.js
const crypto = require('crypto');
const express = require('express');
const app = express();

// Use raw body for signature verification
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf;
  }
}));

app.post('/webhook/mangoform', (req, res) => {
  const signature = req.headers['x-mangoform-signature'];
  const webhookSecret = 'your_webhook_secret'; // Get this from your webhook settings

// Create expected signature
  const hmac = crypto.createHmac('sha256', webhookSecret);
  const expectedSignature = hmac.update(req.rawBody).digest('hex');

// Compare signatures
  if (signature !== expectedSignature) {
    console.error('Invalid webhook signature');
    return res.status(403).send('Invalid signature');
  }

// Process the webhook event
  const event = req.body;
  console.log('Received verified webhook:', event);

res.status(200).send('Webhook received');
});

app.listen(3000, () => {
  console.log('Webhook server running on port 3000');
});

Detailed Security Guide Coming Soon

We're working on a comprehensive security guide for webhooks. Check back soon for detailed best practices and implementation examples.

Security Best Practices

Follow these best practices to ensure your webhook implementation is secure:

Always Verify Signatures

Always verify the signature of incoming webhooks to ensure they are coming from MangoForm.

Use HTTPS

Always use HTTPS for your webhook endpoint to ensure data is encrypted in transit.

Keep Secrets Secure

Store your webhook secret securely and never expose it in client-side code.

Implement Timeouts

Set appropriate timeouts for webhook processing to prevent long-running operations.

Validate Payload

Always validate the webhook payload structure before processing it.