Beginner LevelAuthentication & Authorization
What is HMAC Request Signing and how does it prevent API payload tampering?
❓ Interview Prompt: Explain Hash-based Message Authentication Codes (HMAC), HTTP request canonicalization, replay prevention, and signature headers.
HMAC (Hash-based Message Authentication Code) Request Signing is a security technique used by high-security APIs (such as AWS Signature V4, Stripe Webhooks, or financial gateways) to verify both identity and payload integrity.
How HMAC Request Signing Works:
1
Canonicalization: Client constructs a canonical string combining HTTP Method, Path, Timestamp, Nonce, and Request Body.
2
Signature Computation: Client computes HMAC-SHA256 signature using a shared secret key:
$$\text{Signature} = \text{HMAC-SHA256}(\text{CanonicalString}, \text{SecretKey})$$
3
Header Transmission: Client sends signature and timestamp in HTTP headers ('X-Signature', 'X-Timestamp').
4
Server Verification: Server re-computes the HMAC signature using the stored secret key and asserts exact match + timestamp freshness (< 5 mins).
Code Implementation Example
typescript
import crypto from 'crypto';
function verifyHmacWebhookSignature(payload: string, signatureHeader: string, secret: string): boolean {
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
// Use timing-safe comparison to prevent timing attacks
return crypto.timingSafeEqual(
Buffer.from(signatureHeader, 'hex'),
Buffer.from(expectedSignature, 'hex')
);
}💡Verifying webhook payload HMAC signature using timing-safe comparison.
🎯 Interview Key Takeaway
HMAC request signing verifies request body integrity and identity using a shared secret key without sending raw secrets over the wire.
#HMAC#API Security#Request Signing#Webhooks#Beginner
Back to all Authentication & Authorization Questions→