How to Secure Webhooks with HMAC in n8n?

The Vulnerability of the Open Webhook Endpoint

When building workflows on platforms like n8n, Zapier, or Make, the Webhook Trigger node provides a public URL like https://n8n.yourcompany.com/webhook/stripe-checkout.

Most beginners assume that because the URL path contains a randomized alphanumeric string, the endpoint is secure. In cybersecurity, this is known as security through obscurity.

If a bot scanner discovers that URL, or if a disgruntled former contractor copies it from a past repository, they can flood your workflow with thousands of fake POST requests:

• Injecting fake orders into your database.
• Triggering automated SMS messages via Twilio that exhaust your balance.
• Firing LLM summarization calls that drain your OpenAI or Anthropic API quotas.
• Corrupting your CRM attribution records with malicious junk leads.

Securing webhooks is not optional. It is the frontline defense of your operational infrastructure.

Security Models Compared: Open vs. Basic Auth vs. HMAC-SHA256

Different authentication methods provide varying degrees of security in automated pipelines:

Leading platforms like Stripe, Shopify, GitHub, and Twilio require HMAC signatures because they prevent both data forgery and interception attacks.

The 4-Step Verification Handshake

Here is exactly what happens during a secure webhook verification handshake:

Production Implementation: Constant-Time HMAC Verification in n8n

Below is a complete, production-grade JavaScript snippet for an n8n Code Node. It verifies Stripe-style signatures, enforces a 300-second timestamp tolerance, and uses constant-time buffer comparison:

// Production n8n Code Node: Cryptographic HMAC-SHA256 Verification
const crypto = require('crypto');

// 1. Retrieve raw payload and headers from n8n webhook
const webhookData = $input.first().json;
const rawBodyString = typeof webhookData.rawBody === 'string' 
  ? webhookData.rawBody 
  : JSON.stringify(webhookData.body);

const headers = webhookData.headers || {};
const signatureHeader = headers['stripe-signature'] || headers['x-hub-signature-256'] || '';
const signingSecret = process.env.WEBHOOK_SIGNING_SECRET || 'whsec_YourSigningSecretKey32Chars';

// 2. Parse timestamp and signature elements (Stripe format: t=1614555833,v1=...)
let timestamp = null;
let providerSignature = null;

if (signatureHeader.includes('t=') && signatureHeader.includes('v1=')) {
  const parts = signatureHeader.split(',');
  for (const part of parts) {
    const [key, value] = part.split('=');
    if (key.trim() === 't') timestamp = parseInt(value, 10);
    if (key.trim() === 'v1') providerSignature = value.trim();
  }
} else {
  // Generic header fallback
  providerSignature = signatureHeader.replace('sha256=', '').trim();
  timestamp = Math.floor(Date.now() / 1000);
}

// 3. Defense against Replay Attacks: Check 300-second tolerance window
const currentTimestamp = Math.floor(Date.now() / 1000);
const maxToleranceSeconds = 300;

if (!timestamp || Math.abs(currentTimestamp - timestamp) > maxToleranceSeconds) {
  throw new Error(`[Security Alert] Webhook rejected: Timestamp outside tolerance window (${Math.abs(currentTimestamp - timestamp)}s skew).`);
}

// 4. Recompute HMAC-SHA256 hash
const signedPayload = timestamp ? `${timestamp}.${rawBodyString}` : rawBodyString;
const calculatedSignature = crypto
  .createHmac('sha256', signingSecret)
  .update(signedPayload, 'utf8')
  .digest('hex');

// 5. Timing Attack Defense: Constant-Time Buffer Comparison
const bufferA = Buffer.from(calculatedSignature, 'hex');
const bufferB = Buffer.from(providerSignature, 'hex');

if (bufferA.length !== bufferB.length || !crypto.timingSafeEqual(bufferA, bufferB)) {
  throw new Error('[Security Alert] Invalid Webhook Signature: Forged payload rejected.');
}

// 6. Return verified payload to downstream business nodes
return {
  json: {
    verified: true,
    senderTimestamp: new Date(timestamp * 1000).toISOString(),
    payload: webhookData.body,
    traceId: crypto.randomUUID()
  }
};

Why Standard String Comparison (===) Is a Security Flaw

Notice step 5 in the code snippet above: crypto.timingSafeEqual(bufferA, bufferB).

Many developers make the mistake of writing:

if (calculatedSignature === providerSignature) { ... }

In standard JavaScript engines, the === operator compares strings character by character from left to right. The moment it detects a mismatch, it stops and returns false.

If an attacker submits a forged signature where the first 4 characters match, the comparison takes slightly longer (e.g., 20 nanoseconds longer) than if the very first character failed. By measuring thousands of requests with high-resolution network timers, attackers can reverse-engineer signatures byte by byte in a technique known as a Timing Attack.

Using crypto.timingSafeEqual() forces the engine to examine every single byte regardless of where the mismatch occurs, completely neutralizing timing analysis. Learn more in our AI Consulting Services.

The 10-Point Webhook Security Hardening Standard

Before exposing any production webhook to live customer traffic, audit your architecture against these 10 standards:

Frequently Asked Questions