January 2023 Summaries

The concept of webhook secrets and their importance in preventing impersonation attacks is crucial. Webhook secrets are used to sign every webhook and its metadata with a unique secret key, ensuring the security of the signature scheme. However, when these secrets need to be rotated for security reasons, it can cause downtime issues as verifying endpoints may fail to verify webhooks signed with the new key until they are updated. To solve this problem, signing webhooks with both the old and new keys for a set period of time allows webhook consumers enough time to update their endpoints to use the new key, making zero downtime secret rotation possible.