NETFOXHUBnetfox.space
Home/Tools/Webhook & Header Tester

CORS & Security Header Auditor & HMAC Webhook Calculator

Diagnose missing security headers (CSP, HSTS, X-Frame-Options) and detect CORS vulnerabilities. Calculate and verify HMAC SHA256/512 message digests for Stripe, GitHub, Shopify, and VNPay with zero-latency WebCrypto.

AdvertisementNetfox Developer Network Sponsor Slot

CORS Protocol Architecture, Preflights & Security Boundaries

Cross-Origin Resource Sharing (CORS) is a browser-enforced security mechanism defined by the W3C and WHATWG. When a client-side application issues a non-simple request (such as a POST with a Content-Type: application/json or custom headers), the user agent first dispatches an HTTP OPTIONS preflight request to inspect the server's permission policies before executing the actual request.

Critical CORS misconfigurations include:

  • Wildcard Origin with Credentials: Setting Access-Control-Allow-Origin: * alongside Access-Control-Allow-Credentials: true is blocked by modern browsers because it exposes authenticated user state to arbitrary origins.
  • Reflection of Arbitrary Origin Headers: Dynamically echoing back the untrusted Origin request header without server-side allowlist verification allows attackers to bypass cross-origin boundaries.
  • Uncached Preflight Latency: Omitting Access-Control-Max-Age forces browsers to repeat the preflight handshake for every API call, adding unnecessary network round-trips.

RFC 2104 HMAC Verification in Payment Webhooks

Payment providers (Stripe, PayPal, VNPay) and developer platforms (GitHub, Slack, Shopify) sign webhook delivery payloads with HMAC (Hash-based Message Authentication Code).

For Stripe, the signature header contains a timestamp t=... and signature v1=... computed over timestamp + "." + rawBody. This prevents replay attacks by ensuring payloads older than the tolerance window (typically 5 minutes) are rejected.

Mitigating Timing Attacks in Webhook Receivers

When verifying cryptographic digests on backend servers, never use standard equality operators (a === b) or string comparison functions that return early upon discovering a non-matching character. Always use constant-time comparison primitives (e.g. crypto.timingSafeEqual in Node.js or subtle.verify in Web APIs) to prevent side-channel timing exploits.

AdvertisementNetfox Developer Network Sponsor Slot

Explore More Developer Utilities

View All Tools →
Diff Engine

Text Diff & Code Comparison

Compare text, JSON, SQL, and code files with line & character diffing.

Launch tool→
String Utilities

Case Converter & SEO Slug

Transform camelCase, snake_case, PascalCase, and clean SEO slugs.

Launch tool→
Markdown

Markdown Live Editor

Real-time GFM editor with visual table builder and HTML export.

Launch tool→
Photo Studio

Image Enhancer & Compressor

Paste Ctrl+V, 16:9/1:1 crop framing, unsharp masking, and WebP compression.

Launch tool→

Webhook & Header Tester FAQ

Frequently asked questions on CSP, HSTS, CORS rules, and HMAC webhook signature calculation.

What is Cross-Origin Resource Sharing (CORS) and why does wildcard with credentials fail?▼

CORS is a W3C browser security mechanism that restricts web pages from making HTTP requests to a different origin (domain, protocol, or port) than the one that served the web page. According to the CORS specification, configuring 'Access-Control-Allow-Origin: *' combined with 'Access-Control-Allow-Credentials: true' is strictly prohibited by browsers to prevent malicious websites from harvesting cross-origin session cookies and authenticated user data.

How does HMAC webhook verification protect API endpoints?▼

HMAC (Keyed-Hash Message Authentication Code, RFC 2104) uses a shared secret key and a cryptographic hash function (such as SHA-256) to sign the payload body. The receiver calculates the expected hash over the incoming raw body and secret. If the hashes match, the receiver knows with mathematical certainty that the payload was created by the sender (authenticity) and was not modified in transit (integrity).

Why should webhook signatures be compared using constant-time algorithms?▼

Standard string equality comparisons ('===') terminate as soon as they encounter the first mismatched byte. An attacker measuring network response latency with sub-microsecond precision can iteratively deduce each character of the valid signature (timing attack). Using constant-time comparisons (such as timingSafeEqual) ensures the comparison takes identical time regardless of where mismatches occur.

Which essential security headers should every production API and website configure?▼

Every production service should declare Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy to defend against XSS, clickjacking, protocol downgrades, and device API exploitation.