# Webhook Security

Learn how to secure your webhook implementation and verify webhook authenticity.

## Signature Verification

MangoForm signs webhook payloads with a secret key using HMAC-SHA256. You should verify this signature to ensure the webhook is legitimate.

```javascript

// Example signature verification in Node.js
const crypto = require('crypto');
const express = require('express');
const app = express();

// Use raw body for signature verification
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf;
  }
}));

app.post('/webhook/mangoform', (req, res) => {
  const signature = req.headers['x-mangoform-signature'];
  const webhookSecret = 'your_webhook_secret'; // Get this from your webhook settings

// Create expected signature
  const hmac = crypto.createHmac('sha256', webhookSecret);
  const expectedSignature = hmac.update(req.rawBody).digest('hex');

// Compare signatures
  if (signature !== expectedSignature) {
    console.error('Invalid webhook signature');
    return res.status(403).send('Invalid signature');
  }

// Process the webhook event
  const event = req.body;
  console.log('Received verified webhook:', event);

res.status(200).send('Webhook received');
});

app.listen(3000, () => {
  console.log('Webhook server running on port 3000');
});
```

## Detailed Security Guide Coming Soon

We're working on a comprehensive security guide for webhooks. Check back soon for detailed best practices and implementation examples.

## Security Best Practices

Follow these best practices to ensure your webhook implementation is secure:

### Always Verify Signatures

Always verify the signature of incoming webhooks to ensure they are coming from MangoForm.

### Use HTTPS

Always use HTTPS for your webhook endpoint to ensure data is encrypted in transit.

### Keep Secrets Secure

Store your webhook secret securely and never expose it in client-side code.

### Implement Timeouts

Set appropriate timeouts for webhook processing to prevent long-running operations.

### Validate Payload

Always validate the webhook payload structure before processing it.