Introduction

When building email-driven workflows, security should be a top priority. This guide covers essential security practices for your MailWebhook integration.

Verify Webhook Signatures

Every webhook from MailWebhook includes a signature header. Always verify it:

const crypto = require('crypto')

function verifyWebhookSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex')
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-mailwebhook-signature']
  const isValid = verifyWebhookSignature(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  )
  
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' })
  }
  
  // Process webhook...
})

Validate Email Content

Never trust email content blindly:

  1. Sanitize HTML content before rendering
  2. Validate attachments before processing
  3. Be cautious with links in email bodies

Use HTTPS

Always use HTTPS endpoints for your webhooks. This ensures data is encrypted in transit.

Implement Rate Limiting

Protect your endpoints from abuse with rate limiting:

const rateLimit = require('express-rate-limit')

const webhookLimiter = rateLimit({
  windowMs: 1 * 60 * 1000, // 1 minute
  max: 100, // 100 requests per minute
  message: 'Too many requests'
})

app.use('/webhook', webhookLimiter)

Conclusion

Security is an ongoing process. Regularly review your webhook handlers and keep dependencies updated to protect your email workflows.