HMAC Signatures Explained: How to Verify Webhook Authenticity

·1 views

Webhooks allow external systems to respond to events in real time, but any party with a known endpoint URL can send fraudulent requests impersonating the source. HMAC (Hash-Based Message Authentication Code) addresses this by cryptographically signing each webhook using a shared secret key held by both sender and receiver. The sender computes an HMAC-SHA256 hash of the webhook body and transmits it as a request header, typically named X-Signature or X-Webhook-Signature. The receiving system independently recomputes the hash and compares it to the header value, rejecting the request if there is any mismatch. This approach confirms both the authenticity and integrity of the webhook without transmitting any secret over the network.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Codename One Tutorial Shows How to Build a First-Person 3D Dungeon Game

The third installment of the Game Builder tutorial series extends the data-driven design approach from earlier 2D tutorials into a first-person 3D dungeon experience called Crypt Walk. Built using Codename One, an open-source Java and Kotlin framework for cross-platform app development, the project uses the same authoring workflow but renders elements as GPU-powered 3D models under a perspective camera with lighting. A key distinction from 2D development is the use of mesh assets in glTF or .glb format instead of sprites or image sheets, with the framework's GltfLoader handling runtime rendering. The tutorial introduces play styles such as dungeon, open, and flight, which automatically configure the camera, movement model, and collision behavior to match the chosen genre. Developers can build maze walls using a Terrain Wall brush tool, which joins adjacent cells into seamless corridors and enforces wall collision in dungeon mode without additional configuration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why 'Our Logic Changes Too Fast for Tests' Is a Developer Red Flag

A software developer recounts a technical interview where a CTO justified skipping automated testing by arguing that rapidly changing business logic made tests impractical. The author contends this reasoning is flawed, since frequent code changes in production actually increase risk and make test coverage more critical, not less. Without automated tests, teams must rely on manual checks and collective memory, both of which become unreliable as systems grow and staff turns over. Tests primarily serve as a safety net for modifying existing behaviour, helping developers catch unintended side effects across complex, interconnected codebases. The piece argues that fast-moving startups stand to benefit most from testing discipline, and that skipping it tends to slow down releases and raise costs over time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Consultant Manages 31 Projects Across 5 AI Models Using Quota Discipline

A public administration consultant running 31 concurrent projects developed a structured AI routing system after struggling with premium model quota limits. The challenge intensified when Anthropic released Claude Fable 5, a high-capability reasoning model made available to Pro and Max subscribers at 50% of weekly limits on a rolling promotional basis through at least July 19. Because Fable 5 consumes subscription allowances faster than standard models, the consultant was forced to deploy it tactically rather than freely. This scarcity pressure led to a deliberate task-routing discipline: reserving Fable 5 for complex reasoning, while distributing other work across Opus, Sonnet, Gemini, Grok, and local models running Gemma and Llama via Ollama. The resulting system — including a burn-down schedule tied to quota reset times and a fallback plan — has since become a repeatable weekly workflow.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev team swaps Chromium for 1MB .NET library to generate PDFs in Azure Functions

A software developer evaluated Bhowra.Ink, a lightweight, Chromium-free HTML-to-PDF rendering library for .NET, as an alternative to headless browser-based document pipelines. The motivation was to reduce deployment overhead, since browser-based PDF generation typically adds hundreds of megabytes of binaries, slowing build times, increasing cold starts, and expanding the security vulnerability surface. Serverless platforms like Azure Functions and AWS Lambda are particularly affected, as browser process startup time adds latency to every cold start. Bhowra.Ink is designed as a standard .NET package with no browser process, Node.js runtime, or native interop required. The developer argues the approach suits static business documents such as invoices and payslips, while acknowledging that JavaScript-heavy or SPA-rendered documents still warrant full browser-based tools like Playwright or Puppeteer.

0 comments Read more at DEV Community