Dev Tools · 5h ago
Laravel webhook signing bug: double JSON encode breaks HMAC
A common Laravel mistake signs webhook payloads with one JSON encoding but sends another, causing silent HMAC failures. The bug occurs when developers manually json_encode for the signature but pass the array to Laravel's HTTP client, which re-encodes it. The fix is to serialize once and send the exact string to ensure byte-for-byte matching.
Meridian48 take
This is a sharp reminder that even simple cryptographic primitives break on subtle serialization mismatches, a lesson that applies far beyond Laravel.
Read the full reporting
Signing webhook payloads in Laravel - and the mistake that breaks it silently →
DEV Community
laravelwebhooks