Webhook without signature verification or idempotency

errorwebhook-without-signature-or-idempotency

A webhook is a public endpoint that its caller retries. Without signature verification anyone can post a fake event; without idempotency the provider's own retries apply the same event twice.

Severity: error
Selects: every node of kind webhook-endpoint
Components in scope: 4

What it checks

It looks at every node of kind webhook-endpoint, and fires when:

— any of these hold:
— the node's `signatureVerified` is false
— the node's `idempotent` is false

Message

Webhook '{{node.id}}' does not verify signatures or is not idempotent. Verify the caller's signature and deduplicate by event id.

{{node.id}} style paths are filled in from the node, the edge or the design the finding is about.

Applies to · 4 components

Webhook endpoint webhook-endpoint

Tripped by · 5

Reference designs whose broken twin names this rule in its header. The gate reads the same header, and fails when a rule no design trips.

gojek-platformreference metrics-monitoringreference payment-systemreference stripe-paymentsreference twitch-livereference

Source

1# yaml-language-server: $schema=../schema/rule.schema.json
2# A webhook is a public endpoint that the caller retries. Without signature verification
3# anyone can post a fake "payment succeeded"; without idempotency the provider's own
4# retries apply the same event twice.
5# Tripped by: designs/payment-system.broken.yaml
6schemaVersion: "1"
7type: "rule"
8id: "webhook-without-signature-or-idempotency"
9severity: "error"
10select:
11  node:
12    kind: "webhook-endpoint"
13when:
14  any:
15    - prop: "signatureVerified"
16      equals: false
17    - prop: "idempotent"
18      equals: false
19message: "Webhook '{{node.id}}' does not verify signatures or is not idempotent. Verify the caller's signature and deduplicate by event id."

The same page as markdown, for an agent: /catalogue/rules/webhook-without-signature-or-idempotency.md