In modern open developer platforms, Webhooks are the primary egress channel for broadcasting domain events to external systems:

Receiver Outages: When external developer endpoints experience downtime, the platform must not hold worker threads indefinitely or drop critical events;
Payload Integrity & Anti-Tampering: Callers require strong cryptographic X-Signature-SHA256 headers to verify message authenticity;
Internal SSRF Attack Defense: Attackers must be prevented from configuring webhook URLs pointing to http://127.0.0.1 or private subnet assets!

BitzOrcas.Modern Webhooks Module implements “SSRF Hardened Egress + Outbox Dispatch + Exponential Retry Schedulers”:

Webhooks Delivery and Retry Lifecycle

Step 1: HMAC-SHA256 Payload Signature Engine

The delivery engine computes standard cryptographic signatures for receiver verification:

using System.Security.Cryptography;
using System.Text;

public static class WebhookSigner
{
    // Computes signature: v1={HMAC(secret, timestamp + "." + payload)}
    public static string ComputeSignature(string payload, string secret, long timestamp)
    {
        // 1. Construct canonical signature string
        var signaturePayload = $"{timestamp}.{payload}";
        var keyBytes = Encoding.UTF8.GetBytes(secret);
        var payloadBytes = Encoding.UTF8.GetBytes(signaturePayload);

        // 2. In-memory HMAC computation
        using var hmac = new HMACSHA256(keyBytes);
        var hashBytes = hmac.ComputeHash(payloadBytes);

        // 3. Return hex-encoded signature string
        return $"v1={Convert.ToHexString(hashBytes).ToLowerInvariant()}";
    }
}

Step 2: Anti-SSRF Target Address Sanitization

Before sending outbound HTTP requests, the address validator blocks private IP ranges:

using System.Net;

public sealed class WebhookAddressValidator : IWebhookAddressValidator
{
    public async Task<bool> IsUrlSafeAsync(Uri targetUrl, CancellationToken ct)
    {
        // 1. Enforce HTTPS in production environments
        if (targetUrl.Scheme != Uri.UriSchemeHttps) return false;

        // 2. Resolve DNS IP addresses
        var hostAddresses = await Dns.GetHostAddressesAsync(targetUrl.Host, ct);
        foreach (var ip in hostAddresses)
        {
            // 3. Block loopback (127.0.0.1) and private RFC 1918 subnets (10.0.0.0/8, 192.168.0.0/16)
            if (IPAddress.IsLoopback(ip) || ip.ToString().StartsWith("192.168.") || ip.ToString().StartsWith("10."))
            {
                return false; // SSRF attempt blocked
            }
        }

        return true;
    }
}

Summary

The Webhooks Module powers reliable partner integrations:

Tamper-Proof Signatures: HMAC-SHA256 with timestamp headers prevents replay attacks;
Resilient Delivery: Exponential backoffs smoothly tolerate downstream outages;
SSRF Defense: Physical DNS validation shields internal infrastructure.