What is Request Signing?
Cryptographically signing HTTP requests to verify their authenticity and integrity.
Definition
Request signing is the process of creating a cryptographic signature for an HTTP request using a shared secret or private key. The sender computes a hash (typically HMAC-SHA256) of the request body and includes it as a header. The receiver recomputes the hash using the same secret and compares it — if they match, the request is authentic and has not been tampered with. This is the standard security mechanism for webhook verification.
Simple Analogy
Like a wax seal on a letter — it proves who sent it (authentication) and that the contents have not been altered (integrity). If the seal is broken or missing, you know not to trust the letter.
Why It Matters
Without request signing, anyone who discovers your webhook endpoint URL can send fake events. Request signing prevents spoofing and tampering attacks. CronJobPro includes request signing for webhook notifications, allowing your endpoint to verify that incoming webhooks genuinely originated from CronJobPro and have not been modified in transit.
How to Verify
Verify that your webhook sender includes a signature header (commonly X-Signature, X-Hub-Signature-256, or similar). On your receiver, implement signature verification: compute the HMAC of the raw request body using your shared secret and compare it to the header value. Reject requests where signatures do not match.
Common Mistakes
Not verifying signatures on the receiver side, defeating the purpose of signing. Using a weak hashing algorithm (MD5 or SHA-1 instead of SHA-256). Comparing signatures using a non-constant-time function, which is vulnerable to timing attacks. Parsing the request body before verification, allowing tampered data to influence processing.
Best Practices
Always verify request signatures before processing webhook payloads. Use HMAC-SHA256 or stronger. Compare signatures using constant-time comparison functions to prevent timing attacks. Verify against the raw request body (not parsed JSON) to catch any modification. Rotate signing secrets periodically and support multiple active secrets during rotation.
HTTP Methods Guide
Learn about HTTP methods
Try it free →Frequently Asked Questions
What is Request Signing?
Request signing is the process of creating a cryptographic signature for an HTTP request using a shared secret or private key. The sender computes a hash (typically HMAC-SHA256) of the request body and includes it as a header. The receiver recomputes the hash using the same secret and compares it — if they match, the request is authentic and has not been tampered with. This is the standard security mechanism for webhook verification.
Why does Request Signing matter for cron jobs?
Without request signing, anyone who discovers your webhook endpoint URL can send fake events. Request signing prevents spoofing and tampering attacks. CronJobPro includes request signing for webhook notifications, allowing your endpoint to verify that incoming webhooks genuinely originated from CronJobPro and have not been modified in transit.
What are best practices for Request Signing?
Always verify request signatures before processing webhook payloads. Use HMAC-SHA256 or stronger. Compare signatures using constant-time comparison functions to prevent timing attacks. Verify against the raw request body (not parsed JSON) to catch any modification. Rotate signing secrets periodically and support multiple active secrets during rotation.
Related Terms
HMAC Signature
A cryptographic hash used to verify that a webhook request is authentic and has not been tampered with.
Webhook Signature Verification
Validating that an incoming webhook request is authentic by checking its cryptographic signature.
Authentication
Verifying the identity of a user or system making a request to your endpoint.
HTTPS
The secure version of HTTP that encrypts all communication between client and server.
Secret
Any sensitive credential — passwords, API keys, tokens — that must be protected from exposure.