# `react-doctor/webhook-signature-risk`

An inbound webhook handler that acts on the request body without verifying the provider's signature will process forged requests from anyone.

- **Category:** Security
- **Severity:** warn
- **Source:** oxlint-plugin-react-doctor
- **Framework:** global
- **Enabled when:** production source files that look like an inbound webhook handler (path or de-commented content mentions "webhook"); outbound/sender webhook files excluded

## Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires on a production file identified as an INBOUND webhook handler (its path, or its content with comments/strings stripped, mentions `webhook`) that exposes an entrypoint — `export [async] function POST`, `export const POST|handler|webhook`, `webhookHandler`, or `webhookRoute` — and reads the request (`req`/`request`), yet shows NO signature-verification evidence anywhere in the file. Evidence that suppresses it: `verifySignature`/`verify*signature`/`verify*(Webhook|Auth)`, Stripe `constructEvent`/`stripe.webhooks`, `createHmac` + `timingSafeEqual`, `svix`, `webhookSecret`, or reading a `*signature*` header. Outbound senders are excluded (`process.env.*WEBHOOK_URL`, `send/post/dispatch/publish/notify*Webhook`, and bare `webhookUrl` mentions are stripped before judging). FALSE POSITIVE: verification done in shared middleware or a wrapper in another module (this file has no textual evidence), or a re-export like `export const POST = stripeWebhookHandler;` whose body lives elsewhere.

## Fix prompt

Use this once validation confirms the diagnostic is real.

Verify the provider's signature before parsing or acting on the body: use the SDK helper (Stripe `webhooks.constructEvent`, `svix` for Clerk) or compute an HMAC over the raw request body with the shared secret and compare with `crypto.timingSafeEqual`. Use the raw body, not parsed JSON, for the comparison, and reject with 400/401 on mismatch. Keep the webhook secret in server-only env, and if verification lives in shared middleware, confirm it runs for this route.