--- title: Webhook Security | daily.dev description: An overview of the main security threats facing webhook delivery systems and how to mitigate them: server-side request forgery (SSRF), spoofing, replay... canonical: https://daily.dev/posts/webhook-security-q6w3a0knz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Webhook Security | daily.dev og:description: An overview of the main security threats facing webhook delivery systems and how to mitigate them: server-side request forgery (SSRF), spoofing, replay... og:url: https://daily.dev/posts/webhook-security-q6w3a0knz og:image: https://api.daily.dev/og/posts/Q6w3A0kNZ.png og:image:alt: Webhook Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Webhook Security **[Svix Blog](https://daily.dev/sources/svix)** · 6 min read · 0 upvotes · 0 comments ## Summary An overview of the main security threats facing webhook delivery systems and how to mitigate them: server-side request forgery (SSRF), spoofing, replay attacks, and man-in-the-middle attacks. Covers mitigation strategies including proxying requests through IP-filtering proxies like smokescreen, signing payloads with HMAC-SHA256, using signed timestamps and idempotency IDs, requiring HTTPS, and the trade-offs of IP allow lists and mTLS. Written from the perspective of Svix, a webhook delivery service. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I prevent SSRF attacks in a webhook delivery system? Proxy all outgoing webhook requests through a filtering proxy such as Stripe's smokescreen that blocks calls to internal IP addresses, and run the webhook workers or proxy in their own private subnet without access to internal services. This prevents attackers from supplying URLs that let the webhook system reach internal databases or cloud metadata endpoints. _Teams hardening webhook infrastructure can track SSRF mitigation patterns like this on daily.dev._ ### Why is an IP allow list not enough to secure webhooks? An IP allow list alone is insecure because it is not an authentication mechanism. Cloud providers often share IPs across machines, IP addresses can be released back to a provider and reused maliciously, and multiple customers of the same webhook service can share a sending IP range, letting one customer trigger webhooks that appear to come from another. _daily.dev helps engineers weigh tradeoffs like IP allow lists versus signature verification for webhook auth._ ### What is the recommended way to sign webhook payloads to prevent spoofing? Use HMAC-SHA256 to sign both the payload and metadata like the idempotency ID and timestamp, rather than relying on authentication tokens or IP allow lists. Some implementations use asymmetric signing with Ed25519 or RSA, but HMAC-SHA256 is more common and is the default used by Svix's webhook signing scheme. _daily.dev surfaces practical signing patterns for developers implementing webhook security._ ## Similar posts on daily.dev - [Your Webhook Endpoint Is a Tiny Distributed System](https://daily.dev/posts/your-webhook-endpoint-is-a-tiny-distributed-system-izgpxyxum) · Ruby Flow · 0 upvotes · 0 comments - [The Most Overlooked Vulnerability — Http request Smuggling](https://daily.dev/posts/the-most-overlooked-vulnerability-http-request-smuggling-bkxsg4njj) · InfoSec Write-ups · 0 upvotes · 0 comments - [The valley of webhooks](https://daily.dev/posts/the-valley-of-webhooks-6ekxclvor) · Hacker News · 0 upvotes · 0 comments - [Understanding SSRF: Concepts, Patterns and Practical Exploitation](https://daily.dev/posts/understanding-ssrf-concepts-patterns-and-practical-exploitation-wivb8rtso) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#architecture](https://daily.dev/tags/architecture), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/webhook-security-q6w3a0knz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Webhook Security","url":"https://daily.dev/posts/webhook-security-q6w3a0knz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/webhook-security-q6w3a0knz"},"datePublished":"2026-08-23T07:20:37.684Z","dateModified":"2026-08-23T07:22:57.407Z","description":"An overview of the main security threats facing webhook delivery systems and how to mitigate them: server-side request forgery (SSRF), spoofing, replay...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4f75751d15737d3d486db8cebdfbe17b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4f75751d15737d3d486db8cebdfbe17b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Svix Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Svix Blog","logo":"https://media.daily.dev/image/upload/s--Shf9MlOr--/f_auto,q_auto/v1787469609/logos/svix?_a=BAMAMicg0","url":"https://daily.dev/sources/svix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/webhook-security-q6w3a0knz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,architecture,authentication","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Svix Blog","item":"https://daily.dev/sources/svix"},{"@type":"ListItem","position":3,"name":"Webhook Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/webhook-security-q6w3a0knz#faq","mainEntity":[{"@type":"Question","name":"How do I prevent SSRF attacks in a webhook delivery system?","acceptedAnswer":{"@type":"Answer","text":"Proxy all outgoing webhook requests through a filtering proxy such as Stripe's smokescreen that blocks calls to internal IP addresses, and run the webhook workers or proxy in their own private subnet without access to internal services. This prevents attackers from supplying URLs that let the webhook system reach internal databases or cloud metadata endpoints. Teams hardening webhook infrastructure can track SSRF mitigation patterns like this on daily.dev."}},{"@type":"Question","name":"Why is an IP allow list not enough to secure webhooks?","acceptedAnswer":{"@type":"Answer","text":"An IP allow list alone is insecure because it is not an authentication mechanism. Cloud providers often share IPs across machines, IP addresses can be released back to a provider and reused maliciously, and multiple customers of the same webhook service can share a sending IP range, letting one customer trigger webhooks that appear to come from another. daily.dev helps engineers weigh tradeoffs like IP allow lists versus signature verification for webhook auth."}},{"@type":"Question","name":"What is the recommended way to sign webhook payloads to prevent spoofing?","acceptedAnswer":{"@type":"Answer","text":"Use HMAC-SHA256 to sign both the payload and metadata like the idempotency ID and timestamp, rather than relying on authentication tokens or IP allow lists. Some implementations use asymmetric signing with Ed25519 or RSA, but HMAC-SHA256 is more common and is the default used by Svix's webhook signing scheme. daily.dev surfaces practical signing patterns for developers implementing webhook security."}}]} ```