Rules›northwind-webhook-signature-unverified

northwind-webhook-signature-unverified

error

northwind/security/webhook-signature-unverified

Docs page ↗

The webhook route parses the request body directly with JSON.parse instead of northwind.webhooks.constructEvent, so the handler trusts an event that never proved it came from Northwind.

24

codebases affected, of 58

41%

of everything we scanned

▼17

points since the first docs fix

2

docs commits aimed at this

Where it’s failing

Webhook payload is parsed without verifying the northwind-signature header.

what we find

what we change it to

app.post('/webhooks/northwind', express.json(), async (req, res) => {
const event = req.body // unauthenticated — anyone can POST this
if (event.type === 'charge.succeeded') {
await accounts.activatePro(event.data.customer)
}
res.sendStatus(200)
})
app.post('/webhooks/northwind',
express.raw({ type: 'application/json' }), async (req, res) => {
let event
try {
event = northwind.webhooks.constructEvent(
req.body,
req.headers['northwind-signature'],
process.env.NORTHWIND_WEBHOOK_SECRET,
)
} catch {
return res.sendStatus(400) // bad or missing signature
}
if (event.type === 'charge.succeeded') {
await accounts.activatePro(event.data.customer)
}
res.sendStatus(200)
})

Parse with northwind.webhooks.constructEvent(rawBody, req.headers["northwind-signature"], process.env.NORTHWIND_WEBHOOK_SECRET) inside a try/catch, and return 400 when it throws. The route must receive the raw body — JSON body parsers break the signature.

Metadata

Category
security
Type
problem
Severity
error
CWE
CWE-345
OWASP
A02:2021 Cryptographic Failures
Recommended
yes
Languages
javascriptpython

Live telemetry

24 / 58 scans

Fired in 41% of scanned codebases.

After every docs commit

docs(webhooks): raw-body example ahead of the JSON parser

e6b91d4 · merged 8 weeks ago · PR drafted by api-doctor

27% → 24%▼3pts

docs(webhooks): constructEvent in the quickstart handler

b13e8f6 · merged 4 weeks ago · PR drafted by api-doctor

23% → 18%▼5pts

docs(webhooks): CAUTION — parse the raw body, then verify the signature

drafted today by api-doctor · ready to review

Review & open PR →

A fix for your docs page

Wherever this rule fires, a page on your docs site taught it. api-doctor writes the edit and opens it as a pull request on your docs repo — you review and merge.

Drafted

Edit drafted for your docs page

docs/content/guides/webhooks/receiving-events.mdx · docs(webhooks): CAUTION — parse the raw body, then verify the signature

History

Active

Follow the handler through router-level middleware

2 weeks ago · via GitHub

c41ba07
Superseded

Treat a JSON-parsed body as unverifiable, not just a missing call

7 weeks ago · via GitHub

8e2d95f
Superseded

Initial rule — constructEvent missing on a webhook route

13 weeks ago · via GitHub

3b60fe1