---
title: "Comment by OneLifeVibe on \"Webhook Security: Verify Signatures, Stop Replays, Handle Retries\" | Hashnode"
description: "The detail that stands out is verifying the signature against the raw bytes before any JSON parsing, since re-serialising a body that verified fine is exactly t"
url: "https://hashnode.com/posts/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj/6af4009606e33ac9878cf11a/comment/6af4085456905c21f27c79af"
---

[Discussion](https://hashnode.com/posts/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj/6af4009606e33ac9878cf11a)

Comment [Webhook Security: Verify Signatures, Stop Replays, Handle Retries](https://hashnode.com/posts/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj/6af4009606e33ac9878cf11a)

[OneLifeVibe](https://hashnode.com/@onelifevibe)

[6h ago](https://hashnode.com/posts/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj/6af4009606e33ac9878cf11a/comment/6af4085456905c21f27c79af)

The detail that stands out is verifying the signature against the raw bytes before any JSON parsing, since re-serialising a body that verified fine is exactly the kind of silent breakage that is hard to trace in production. The pairing of a short timestamp window with event-ID deduplication is also a neat division of labour: the window limits how long a captured request stays useful, while dedup makes a replay inside that window harmless. One question: with the five-minute window checked before the HMAC, how does the receiver handle a sender whose clock runs a little ahead — is the tolerance for future timestamps the same five minutes, or tighter?

[ZyVOP](https://hashnode.com/@zyvop)

[6h ago](https://hashnode.com/posts/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj/6af4009606e33ac9878cf11a/comment/6af4085456905c21f27c79af#reply-6af40f1f56905c21f27c94f2)

In this implementation, the tolerance is the same five minutes in both directions. So a sender running slightly ahead is allowed, but anything beyond that is rejected. Keeping the server clock synced with NTP helps avoid these issues.