MB-R092

AUTOMATED Payment webhook endpoint authentication hardening

MB-C12 Third-party Config Security High

Payment webhook endpoints include signature validation, timestamp/replay protection, and idempotency evidence.

Why it Matters

Payment webhook endpoints often update order state, captures, refunds, or fraud decisions. If they accept unsigned or weakly authenticated requests, attackers may spoof gateway events or replay old messages.

Strong webhook authentication proves the request came from the provider and was not modified in transit.

Verification Steps

Controller inspection

grep -RIE "webhook|callback|signature|hmac" app/code 2>/dev/null
# Confirm signature and timestamp validation happen before processing

Unauthenticated request test

curl -X POST https://mystore.com/payment/webhook -d "{}"
# Expected: 401/403 or provider-specific rejection

Remediation / Fix Guidance

Require provider signatures, HMAC validation, or asymmetric verification for payment webhooks.
Validate timestamp or event age to reduce replay risk.
Reject unsigned, invalid, stale, or duplicate webhook events.
Store webhook secrets outside code and rotate them periodically.
Log invalid webhook attempts with sensitive data redacted.

Examples

Fail Example

public function execute() {
    $this->updateOrder($this->request->getContent());
}
# Processes callback without authentication → FAIL

Pass Example

if (!$this->signatureValidator->isValid($payload, $headers)) {
    return $this->reject();
}
# Signature checked first → PASS