Question

A DevSecOps team exposes an internal deployment automation endpoint that receives webhooks from a third-party CI/CD SaaS provider. The provider signs each payload with an HMAC-SHA256 signature using a shared secret and includes a timestamp header. During a security review, an engineer notes that the automation service currently verifies only that the request originates from the provider's published IP ranges before triggering a production deployment. Which change most effectively prevents both forged and replayed deployment requests?

Accepted Answer

Validate the HMAC signature over the raw payload and reject requests whose timestamp falls outside a short tolerance window, tracking recently seen signatures to block reuse

Answer

Terminate TLS at a reverse proxy and require the provider to present a client certificate before the webhook reaches the automation service

Answer

Restrict the endpoint to the provider's IP ranges and additionally require an API key passed as a query-string parameter

Answer

Rotate the shared HMAC secret weekly and log all inbound webhook requests to the SIEM for retrospective correlation