Webhook Signature Validator Worker

Verify Webhooks at the Edge Before They Reach Your Server

A Cloudflare Worker that validates webhook signatures from Stripe, GitHub, Shopify, and Svix at Cloudflare's edge. Invalid payloads are rejected instantly — your origin never sees unverified requests.

What's Included

• Cloudflare Worker with signature validation for four major providers
• Stripe: Stripe-Signature header with HMAC-SHA256 tolerance window
• GitHub: X-Hub-Signature-256 header validation
• Shopify: X-Shopify-Hmac-SHA256 header validation
• Svix: full multi-header signature scheme validation
• Provider routing — forward to different origin paths per webhook source
• Wrangler secrets for all signing keys (never in source)
• README with per-provider configuration walkthrough

How It Works

The Worker reads the provider-specific signature header, recomputes the expected HMAC using the raw request body and your stored signing secret, and compares via constant-time comparison. Mismatches return 401 Unauthorized immediately. Valid requests are forwarded to your origin with all original headers intact.

What You Get

• Edge-level protection against spoofed or replayed webhook requests
• Supports all four major webhook providers out of the box
• Raw body preserved for signature validation — no double-parsing issues
• Signing secrets stored as Wrangler secrets, never exposed in code
• Replay attack protection via timestamp tolerance window (Stripe, Svix)

Requirements

• Cloudflare account (free tier works)
• Signing secrets from your webhook provider dashboards
• Wrangler CLI installed (npm install -g wrangler)