Question
How does Segment compute the x-signature header for Webhooks (Actions) destinations when batching is enabled? Is the signature generated over the entire batched payload or only the first event? Why do signatures sometimes match for unbatched and batched requests even when the payloads differ?
Product
Twilio Segment
Environment
Segment Console
Answer
For Segment Webhooks (Actions) destinations, the x-signature header is used to verify webhook authenticity. When batching is enabled, Segment computes the x-signature using only the first event in the batch, not the entire HTTP request payload. This means that the signature will be identical for both unbatched and batched requests containing the same first event, even if the batched payload includes additional events or is array-wrapped.
As a result, consumers can only verify the integrity of the first event in a batch using the provided signature. Modifications to other events in the batch will not affect signature validation. This behavior is currently expected and confirmed by Segment engineering, though it is not yet documented publicly.
Additional Information