Secure webhooks with HMAC signing tokens

The existing X-Gitlab-Token header sends a static secret in plain text, making webhooks susceptible to interception and replay attacks.

You can now add a signing token to any webhook. GitLab uses the signing token to compute an HMAC-SHA256 signature over:

• The unique webhook ID.
• The request timestamp.
• The webhook payload.

GitLab then sends the result in the webhook-signature header alongside webhook-id and webhook-timestamp headers, following the Standard Webhooks specification.

You can recompute the signature to confirm requests genuinely came from GitLab and that the payload has not been modified. By also validating the timestamp, you can reject replayed requests.

Thanks to Van Anderson and Norman Debald for their community contributions!