What it means
Webhook authentication and replay protection verify that an event came from an authorized sender, was not altered, is timely, and has not already been processed.
Why it matters
A public callback endpoint can trigger privileged automation, making forged or replayed events equivalent to unauthorized commands.
Practical focus
- Define the system boundary, accountable owner, approved purpose, material risks, and decision authority for Webhook Authentication and Replay Protection
- Validate signatures over the raw message, protect keys, check timestamps and event identifiers, enforce a replay window, authorize event types, and acknowledge safely.
- Collect and protect this evidence: key-management records, signature failures, timestamp checks, duplicate-event logs, negative tests, and incident evidence.
- Exercise this failure scenario as a planned test: an attacker replays a valid deployment event and triggers the same privileged action repeatedly.
Common mistakes
- Using the label Webhook Authentication and Replay Protection without defining the exact systems, data, people, decisions, and time period in scope
- Treating a policy statement or tool demonstration as proof that Webhook Authentication and Replay Protection operates consistently in production
- Failing to retain key-management records, signature failures, timestamp checks, duplicate-event logs, negative tests, and incident evidence in a form that lets an independent reviewer reconstruct decisions and changes
- Testing only the normal path and never rehearsing what happens when an attacker replays a valid deployment event and triggers the same privileged action repeatedly.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: