Securing Zoho Sign Webhooks with HMAC authentication

Webhooks Security

Zoho Sign offers you an option to secure your webhooks by using HMAC-SHA 256 (Hash-Based Message Authentication Codes with SHA 256), an industry standard hashing mechanism to ensure the authenticity and integrity of the webhook is intact. Securing a webhook with HMAC will help check:
  1. If the webhook request has been sent from Zoho Sign (The secret key must be known only to Zoho Sign and the receiving application).
  2. If the webhook content has been tampered with along the way (integrity).

How does webhook security work in Zoho Sign?

When a webhook is sent from Zoho Sign, a HMAC signature will be included in the request headers with the name X-ZS-WEBHOOK-SIGNATURE. Upon receiving the webhook request, the receiving application will generate a HMAC signature using the same secret key and compare the results with the value present in the request header. If the value matches, the data is legitimate; otherwise, the data has been tampered with.

Generating a HMAC signature

Zoho Sign calculates the signature of the webhook payload using the HMAC-SHA256 algorithm, and the result is sent in base64 format in the request header. Here is the explanation with sample data:

payload
{{"requests":{"request_name":"Test Name"},"notifications":{"operation_type":"RequestSigningSuccess"}}
secret_key
thisisthesamplekeyfortestingpurposes
base64encode(HMAC SHA-256(payload+secret_key))
drbSrM4H816RYKpZiRBLddUa0yHaTrwjtY04sIZFZus=

Here is an image of how this webhook request header (HMAC header) will look like:


Verifying HMAC signature in the receiving application

  1. You must read the payload as a string to avoid reordering keys when read in JSON format.
  2. Compute HMAC SHA-256 hash of the payload using the secret key and base64 encode the result.
  3. Compare the value obtained from step 2 and the received HMAC header (X-ZS-WEBHOOK-SIGNATURE) value. If there is a mismatch, reject the webhook request.


Sample java cope snippet to verify the HMAC signature

  1.     private static String verifyHmacHash(String secretKey, String payload, String hmacHash) throws Exception 
  2.     {
  3.         String macAlgoName = "HmacSHA256";
  4.         byte[] secretKeyBytes = secretKey.getBytes(StandardCharsets.UTF_8);
  5.         Mac mac = Mac.getInstance(macAlgoName);
  6.         SecretKeySpec keySpec = new SecretKeySpec(secretKeyBytes, mac.getAlgorithm());
  7.         mac.init(keySpec);
  8.         byte[] macData = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
  9.         String calculatedHmac = java.util.Base64.getEncoder().encodeToString(macData);
  10.         
  11.         if(hmacHash.equals(calculatedHmac))
  12.         {
  13.         System.out.println("Hashes match, Webhook payload is valid!!");
  14.         }
  15.         else
  16.         {
  17.         System.out.println("Hashes doesn't match, Webhook payload is tampered!!");
  18.         }
  19.         return calculatedHmac;
  20.     }

    Zoho CRM Training Programs

    Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.

    Zoho CRM Training
      Redefine the way you work
      with Zoho Workplace

        Zoho DataPrep Personalized Demo

        If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.

        Zoho CRM Training

          Create, share, and deliver

          beautiful slides from anywhere.

          Get Started Now


            Zoho Sign now offers specialized one-on-one training for both administrators and developers.

            BOOK A SESSION









                                      You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.




                                          Manage your brands on social media

                                            Zoho Desk Resources

                                            • Desk Community Learning Series


                                            • Digest


                                            • Functions


                                            • Meetups


                                            • Kbase


                                            • Resources


                                            • Glossary


                                            • Desk Marketplace


                                            • MVP Corner


                                            • Word of the Day


                                              Zoho Marketing Automation

                                                Zoho Sheet Resources

                                                 

                                                    Zoho Forms Resources


                                                      Secure your business
                                                      communication with Zoho Mail


                                                      Mail on the move with
                                                      Zoho Mail mobile application

                                                        Stay on top of your schedule
                                                        at all times


                                                        Carry your calendar with you
                                                        Anytime, anywhere




                                                              Zoho Sign Resources

                                                                Sign, Paperless!

                                                                Sign and send business documents on the go!

                                                                Get Started Now




                                                                        Zoho TeamInbox Resources



                                                                                Zoho DataPrep Resources



                                                                                  Zoho DataPrep Demo

                                                                                  Get a personalized demo or POC

                                                                                  REGISTER NOW


                                                                                    Design. Discuss. Deliver.

                                                                                    Create visually engaging stories with Zoho Show.

                                                                                    Get Started Now









                                                                                                        • Related Articles

                                                                                                        • Webhooks

                                                                                                          Webhook is one of the popular call back mechanisms popularly used by developers to integrate any two applications. It provides updates in real-time to the integrated application whenever an event or action occurs. This is a superior solution, unlike ...
                                                                                                        • Security and Legal

                                                                                                          Can I use Zoho Sign to collect sensitive personal data such as credit card information? We strongly discourage the use of Zoho Sign or its associated features to collect sensitive personal data such as credit card information, PIN, and social ...
                                                                                                        • Recipient authentication via Dynamic Knowledge-Based Authentication (KBA)

                                                                                                          Available only in US datacenter on all paid plans and requires Zoho Sign credits Knowledge-based authentication (KBA) is a type of authentication where signers are identified by asking them to answer specific security questions to ensure that the ...
                                                                                                        • Recipient authentication

                                                                                                          Set the authentication code delivery mode for the recipient to authenticate the signing process. Hover over Settings and click Account settings. Click Sending options and navigate to the Recipient authentication section. Enable the Enforce ...
                                                                                                        • Webhooks best practices

                                                                                                          As a technical user, you use webhooks to set up or integrate applications and get real-time updates whenever an event or action occurs. The admin of a Zoho Sign account can configure a webhook and choose the events that will trigger it. The callbacks ...
                                                                                                          Wherever you are is as good as
                                                                                                          your workplace

                                                                                                            Resources

                                                                                                            Videos

                                                                                                            Watch comprehensive videos on features and other important topics that will help you master Zoho CRM.



                                                                                                            eBooks

                                                                                                            Download free eBooks and access a range of topics to get deeper insight on successfully using Zoho CRM.



                                                                                                            Webinars

                                                                                                            Sign up for our webinars and learn the Zoho CRM basics, from customization to sales force automation and more.



                                                                                                            CRM Tips

                                                                                                            Make the most of Zoho CRM with these useful tips.



                                                                                                              Zoho Show Resources