I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it was not altered or spoofed.

I can use a JSON Web Token (JWT) to sign the request and payload with a pre-shared secret key to ensure all of the above.

Is this completely redundant if the webhook is sent over HTTPS anyway?


It depends.

Most regular HTTPS connection are only authenticated for a single side (usually the server), mutual authentication is much less common. When there is only single side authentication, JWT signing can be used to authenticate the other side. If your TLS connection is already mutually authenticated using both Client and Server Certificate, then JWT signing may be redundant.

One case where JWT signing may not be redundant even if you already use mutually authentication is if the recipient needs to save the request and signature to allow an independent third party (e.g. regulators) to be able to audit that you were really the one that made the request (though for this case, you're going to need asymmetric signature rather than preshared key signature).

  • Thanks. Tiny followup here... Do you have a recommended way of publishing the public key? – Shruggie Feb 7 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.