Managing Long Running Tasks medium
When your server receives a Webhook POST from Stripe/GitHub, how do you verify it's actually from them and not a hacker spoofing the request?
- A Check the IP address.
- B Trust the User-Agent.
- C Verify the HMAC Signature in the header (computed using a shared secret).
- D Send an email.
Answer: C. Verify the HMAC Signature in the header (computed using a shared secret).
Standard security practice. IPs can be spoofed or change. Cryptographic signatures are robust.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- What is the primary purpose of a Dead Letter Queue (DLQ)?
- The architectural pattern where one service creates tasks and another processes them is called:
- In a Priority Queue system (High vs Low), what is 'Starvation' and how do you fix it?
- How do you atomically update your local database AND publish a message to a queue without losing sync if the process crashes in between?
- What does 'Fire and Forget' mean?
- Why might you 'Throttle' (limit the speed of) your background workers?