Atlas Webhook HMAC Signature Verification
Parent: MongoDB Atlas on GCP · Published reference · snapshot 2026-10-29
↓ Facts as markdownall context files
Source-anchored research for Atlas Webhook HMAC Signature Verification. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Measurements and reference values
- The integration API specifies fallback to default headers when a header template fails, exceeds 4 KB, or produces an invalid JSON name-to-value object. Receivers must not assume template-provided authentication headers are invariably present. (low confidence) (verified as of 2026-10-29) [source]
Comparisons and alternatives
- The Webhook Secret field generates a signature rather than transmitting a bearer token. Atlas also documents FreeMarker header and body templates, so the secret-field limitation alone does not establish a universal proxy requirement. (medium confidence) (verified as of 2026-10-14) [source]
- HMAC depends on a shared secret, rather than a public verification key. RFC 2104 calls for randomly generated keys, secrecy protection and periodic refresh; apply this key-management guidance to the Atlas signing secret. (medium confidence) [source]
Facts and statements
- With a webhook secret configured, Atlas documents X-MMS-Signature as the Base64 HMAC-SHA-1 of the request body; verification recomputes it with that secret and compares the header. Without a configured secret the signature header is optional. (medium confidence) (verified as of 2026-10-14) [source]
- Implementation advice: retain the original request-body bytes before JSON parsing. With a compatible Node.js crypto build, createHmac('sha1', secret).update(rawBody).digest('base64') implements the documented calculation; reserialization can change signed bytes. This is a derived implementation, not an Atlas-provided code sample. (medium confidence) [source]
- Node.js timingSafeEqual compares bytes in constant time and is suitable for HMAC digests. Its inputs must have equal byte lengths or it throws. Validate lengths first; the surrounding verifier still needs review for timing leaks. (low confidence) [source]
- The Atlas verification procedure describes a MAC of the body and no separate signed delivery timestamp or replay-rejection window. Inference: a matching signature alone does not establish delivery freshness; replay handling requires a receiver policy. This is a documentation boundary, not a demonstrated Atlas vulnerability. (low confidence) (verified as of 2026-10-14) [source]
- The integration API documents custom header templates, but excludes the webhook secret and signature from template variables. Therefore, neither universal bearer-header impossibility nor a mandatory proxy follows from the signing-secret restriction. (medium confidence) (verified as of 2026-10-29) [source]
Children
- No children recorded.