Webhook
In web development, a webhook is a method of augmenting or altering the behavior of a web page or web application with custom callbacks. These callbacks may be maintained, modified, and managed by third-party users who need not be affiliated with the originating website or application. In 2007, Jeff Lindsay coined the term webhook from the computer programming term hook.[1]
Function
Webhooks are "user-defined HTTP callbacks".[2] They are usually triggered by some event, such as pushing code to a repository,[3] a purchase, a comment being posted to a blog[4] and many more use cases.[5] When that event occurs, the source site makes an HTTP request to the URL configured for the webhook. Users can configure them to cause events on one site to invoke behavior on another.
Common uses are to trigger builds with continuous integration systems[6] or to notify bug tracking systems.[7] Because webhooks use HTTP, they can be integrated into web services without adding new infrastructure.[8] As of 2025, half of surveyed API teams reported using webhooks, alongside WebSockets and GraphQL, as a complement to REST.[9]
Authenticating the webhook notification
When the client (the originating website or application) makes a webhook call to the third-party user's server, the incoming POST request should be authenticated to avoid a spoofing attack and its timestamp verified to avoid a replay attack.[10] Different techniques to authenticate the client are used:
- HTTP basic authentication can be used to authenticate the client.[11]
- The webhook can include information about what type of event it is, and a shared secret or digital signature to verify the webhook.
- An HMAC signature can be included as an HTTP header. GitHub,[12] Stripe,[13] Facebook[14] and SignNow[15] use this technique.
- Mutual TLS authentication can be used when the connection is established. The endpoint (the server) can then verify the client's certificate.[16]
The sender may choose to keep a constant list of IP addresses from which requests will be sent. This is not a sufficient security measure on its own, but it is useful for when the receiving endpoint is behind a firewall or NAT.
Server-side request forgery risk
Because a webhook's sender typically lets a user configure an arbitrary destination URL, the OWASP Foundation identifies this as a common vector for server-side request forgery, where the sender's own server can be made to request internal network resources. Recommended mitigation is to re-check the resolved IP before each delivery, not only at registration.[17]
See also
- Application programming interface
- Event-driven architecture
- Open API
- Mashup (web application hybrid)
References
- ↑ Web hook to revolutionize the web, 3 May 2007, http://progrium.com/blog/2007/05/03/web-hooks-to-revolutionize-the-web/
- ↑ "Webhooks". Atlassian. https://developer.atlassian.com/server/jira/platform/webhooks/.
- ↑ About Webhooks - Github Help
- ↑ WordPress Webhooks
- ↑ Use Cases for Webhooks
- ↑ Jenkins GitHub Commit Hooks HOWTO, http://wiki.cloudbees.com/bin/view/DEV/GitHub+Commit+Hooks+HOWTO
- ↑ Google Project Hosting - Post-Commit Web Hooks
- ↑ What are WebHooks and How Do They Enable a Real-time Web?
- ↑ "2025 State of the API Report". Postman, Inc.. 2025. https://www.postman.com/state-of-api/2025/.
- ↑ "Why Verify". Svix Inc.. https://docs.svix.com/receiving/verifying-payloads/why. "Another potential security hole is what's called replay attacks."
- ↑ "DocuSign Connect Now Includes Basic Authentication Support". DocuSign, Inc.. 16 November 2017. https://www.docusign.com/blog/dsdev-docusign-connect-basic-authentication-support/. "the Connect notification service has been updated to support the Basic Authentication scheme with customers’ Connect servers (listeners)."
- ↑ "Securing your webhooks". Github, Inc. https://docs.github.com/en/developers/webhooks-and-events/webhooks/securing-your-webhooks#validating-payloads-from-github.
- ↑ "Checking Webhook Signatures". Stripe, Inc. https://stripe.com/docs/webhooks/signatures.
- ↑ "Getting Started - Graph API - Documentation - Facebook for Developers". Facebook, Inc.. https://developers.facebook.com/docs/graph-api/webhooks/getting-started#validate-payloads.
- ↑ "Webhooks". https://docs.signnow.com/docs/guides-webhooks.
- ↑ "Mutual TLS: Stuff you should know". DocuSign, Inc.. https://www.docusign.com/blog/dsdev-mutual-tls-stuff-know/. "Mutual TLS plus Client Access Control enables your listener app to ensure that the Connect notification message was sent by DocuSign and that it wasn’t modified en route."
- ↑ "Server Side Request Forgery Prevention Cheat Sheet". OWASP Foundation. https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html.
External links
 |  |
