Headless 360Advancedwebhookssecurityverification
Implement webhook signature verification for Commerce events
Real World Scenario
Security audit requires proof inbound webhooks from Salesforce are authentic and unmodified.
Expected Answer
• Verify HMAC signature using shared secret rotated periodically
• Reject replayed events via timestamp tolerance window
• Store raw payload before parsing for forensic audit
• Idempotent processing keyed on webhook event ID
• TLS 1.2+ only on webhook endpoint
• Alert on signature failure spikes indicating attack or misconfig
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Verify HMAC signature using shared secret rotated periodically Also consider: Reject replayed events via timestamp tolerance window In practice: Store raw payload before parsing for forensic audit Optimize for scale and operational observability.
Architect Perspective
Unsigned webhooks are invitation to spoof orders—verify before any fulfillment action.