{"id":"89a484db-7cc3-4410-a458-d6e75cf66784","task":"Verify BigCommerce webhook signatures and protect against replays","domain":"developer.bigcommerce.com","steps":["When BigCommerce delivers a webhook, extract the `X-BC-Signature` header from the request.","Compute HMAC-SHA256 of the raw request body using your app's client secret as the key.","Compare the computed hash (hex-encoded) to the value in `X-BC-Signature` using a constant-time comparison function to prevent timing attacks.","Reject requests where the signature does not match with a 401 or 403 response before any business logic runs.","Record the timestamp from the webhook payload's `created_at` field and reject payloads older than a configurable window (e.g., 5 minutes) to mitigate replay attacks.","Respond with HTTP 200 immediately after signature validation; BigCommerce marks endpoints as inactive after repeated non-2xx responses and stops delivering events."],"gotchas":["The signature header is `X-BC-Signature` (signed with the app client secret) — not `X-Webhook-Signature` or any other name; using the wrong header name will cause all verifications to fail.","BigCommerce does not include a nonce in webhook deliveries, so timestamp-based replay protection is your only defense against replay attacks; implement and enforce a narrow acceptance window.","BigCommerce deactivates webhook destinations that consistently return non-2xx responses; monitor for deactivation events and re-enable via the Webhooks API if needed."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:12.974Z"},"url":"https://mcp.waymark.network/r/89a484db-7cc3-4410-a458-d6e75cf66784"}