NETFOXHUBnetfox.space
Home/Tools/Webhook & Header Tester

CORS & Security Header Auditor & HMAC Webhook Calculator

Diagnose missing security headers (CSP, HSTS, X-Frame-Options) and detect CORS vulnerabilities. Calculate and verify HMAC SHA256/512 message digests for Stripe, GitHub, Shopify, and VNPay with zero-latency WebCrypto.

Module CSecurity Diagnostic • WebCrypto Subtles

Webhook & Header Tester

Paste Raw HTTP Response Headers:
Security Posture Score75 / 100 pts
B

Vulnerabilities / Missing Headers

Missing headers expose the origin to XSS, framing, or MIME-sniffing.

Security Headers Audit Findings5 / 7 Configured
Content-Security-PolicyMISSING

Protects against Cross-Site Scripting (XSS) and data injection attacks.

Add CSP header e.g., default-src 'self'; script-src 'self';
Strict-Transport-Security (HSTS)PRESENT

Enforces HTTPS connections and prevents SSL stripping attacks.

Optimal HSTS max-age configured.max-age=31536000; includeSubDomains; preload
X-Frame-OptionsPRESENT

Prevents clickjacking by disabling embedding inside <iframe> or <frame>.

Good protection against clickjacking attacks.SAMEORIGIN
X-Content-Type-OptionsPRESENT

Stops browser MIME-sniffing away from the declared content-type.

Properly set to nosniff.nosniff
Referrer-PolicyPRESENT

Controls what referrer information is sent with outbound requests.

Referrer policy explicitly configured.strict-origin-when-cross-origin
Permissions-PolicyMISSING

Disables browser device APIs (geolocation, camera, payment) for embedded origins.

Add Permissions-Policy: camera=(), microphone=(), geolocation=()
CORS ConfigurationPRESENT

CORS origin header present.

Verify only trusted consumer domains are allowed.Origin: *
Ready-to-Paste Remediation Snippets
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
AdvertisementNetfox Developer Network Sponsor Slot

CORS Protocol Architecture, Preflights & Security Boundaries

Cross-Origin Resource Sharing (CORS) is a browser-enforced security mechanism defined by the W3C and WHATWG. When a client-side application issues a non-simple request (such as a POST with a Content-Type: application/json or custom headers), the user agent first dispatches an HTTP OPTIONS preflight request to inspect the server's permission policies before executing the actual request.

Critical CORS misconfigurations include:

  • Wildcard Origin with Credentials: Setting Access-Control-Allow-Origin: * alongside Access-Control-Allow-Credentials: true is blocked by modern browsers because it exposes authenticated user state to arbitrary origins.
  • Reflection of Arbitrary Origin Headers: Dynamically echoing back the untrusted Origin request header without server-side allowlist verification allows attackers to bypass cross-origin boundaries.
  • Uncached Preflight Latency: Omitting Access-Control-Max-Age forces browsers to repeat the preflight handshake for every API call, adding unnecessary network round-trips.

RFC 2104 HMAC Verification in Payment Webhooks

Payment providers (Stripe, PayPal, VNPay) and developer platforms (GitHub, Slack, Shopify) sign webhook delivery payloads with HMAC (Hash-based Message Authentication Code).

For Stripe, the signature header contains a timestamp t=... and signature v1=... computed over timestamp + "." + rawBody. This prevents replay attacks by ensuring payloads older than the tolerance window (typically 5 minutes) are rejected.

Mitigating Timing Attacks in Webhook Receivers

When verifying cryptographic digests on backend servers, never use standard equality operators (a === b) or string comparison functions that return early upon discovering a non-matching character. Always use constant-time comparison primitives (e.g. crypto.timingSafeEqual in Node.js or subtle.verify in Web APIs) to prevent side-channel timing exploits.

AdvertisementNetfox Developer Network Sponsor Slot

Webhook & Security Headers FAQ

Frequently asked questions on CORS headers, HMAC signature algorithms, and web application security best practices.

What is Cross-Origin Resource Sharing (CORS) and why does wildcard with credentials fail?▼

CORS is a W3C browser security mechanism that restricts web pages from making HTTP requests to a different origin (domain, protocol, or port) than the one that served the web page. According to the CORS specification, configuring 'Access-Control-Allow-Origin: *' combined with 'Access-Control-Allow-Credentials: true' is strictly prohibited by browsers to prevent malicious websites from harvesting cross-origin session cookies and authenticated user data.

How does HMAC webhook verification protect API endpoints?▼

HMAC (Keyed-Hash Message Authentication Code, RFC 2104) uses a shared secret key and a cryptographic hash function (such as SHA-256) to sign the payload body. The receiver calculates the expected hash over the incoming raw body and secret. If the hashes match, the receiver knows with mathematical certainty that the payload was created by the sender (authenticity) and was not modified in transit (integrity).

Why should webhook signatures be compared using constant-time algorithms?▼

Standard string equality comparisons ('===') terminate as soon as they encounter the first mismatched byte. An attacker measuring network response latency with sub-microsecond precision can iteratively deduce each character of the valid signature (timing attack). Using constant-time comparisons (such as timingSafeEqual) ensures the comparison takes identical time regardless of where mismatches occur.

Which essential security headers should every production API and website configure?▼

Every production service should declare Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy to defend against XSS, clickjacking, protocol downgrades, and device API exploitation.