Hashes, passwords, and MACs
Authenticate messages with a MAC
Use HMAC or a high-level message-authentication API when two trusted parties share a secret and must detect forgery or modification.
8 minute lesson
A plain hash does not prove who created a message. Anyone can calculate another hash after modifying it.
A message authentication code combines the message with a secret key. Verify the exact bytes and use a constant-time library comparison. Keep keys separate by purpose and include context such as version, timestamp, and message type in the authenticated data.
A webhook sender signs the raw JSON body, but the receiver parses and serializes it before verification. Whitespace and key order change the bytes, so authentic requests fail.
An HMAC proves that a shared-secret holder created the exact bytes. It does not prevent replay, and every verifier holding the secret can also forge messages.
Create an HMAC for the exact raw bytes of a small webhook and save a successful verification. Change one byte and verify with the library constant-time comparison. Replay the original valid request and show why a timestamp or event identifier is still required.
Lesson completed