Webhook
An HTTP request that one service sends to a URL another service registered, to report an event. The receiver should verify a signature over the raw body and a timestamp, usually an HMAC, and reject stale or repeated deliveries; the sender should treat registered URLs as an SSRF risk.
- Defined in
- Standard Webhooks specification
Covered in
Verify webhook deliveries before acting
Verify the provider’s signature over the correct bytes, then apply replay, authorization, and idempotency controls before a business action.
Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)
How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.
Abuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Consume third-party APIs safely (OWASP API10:2023)
Treat every upstream and third-party API response as untrusted input: validate it against a schema, set connect and read timeouts, cap the response size, refuse to follow redirects blindly, keep TLS verification on, and scope the credentials you hold for each provider.
Prove network and admission policies enforce the intended boundary
Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
Constrain server-side fetches to their intended destinations
Prevent untrusted URLs from turning a preview, import, or webhook feature into access to internal services.
All 8 pages that cover Webhook in the library
Practice: Privileged container lab: Reject a privileged workload before deployment · Webhook signature and replay lab: Repair a webhook handler that pays twice · SSRF lab: Guard an outbound fetch against SSRF · SSRF validation lab: Validate a fetch URL with ipaddress