Securing Webhooks in Client Chatbots: Implementing SHA-256 HMAC & Geo-Fencing

When automation builders transition from internal hobby projects to deploying AI chatbots on client websites, they frequently overlook a critical security hazard: exposed public webhooks.

If you configure an n8n webhook node and paste that endpoint directly into client-side JavaScript, anyone with basic knowledge of browser developer tools can inspect the Network tab, copy your webhook URL, and run malicious scripts against it.

Without defense-in-depth, an exposed webhook exposes your agency and your client to:

• LLM Quota Depletion: A rogue curl loop sending 10,000 prompts an hour can drain your monthly OpenAI or Anthropic API budget in minutes.
• Prompt Injection & Jailbreaks: Attackers can bypass website boundaries to extract your internal system prompts, database schemas, or proprietary knowledge docs.
• Server DDoS: Flooding self-hosted n8n instances can crash your VPS and take down every workflow running on the server.

Here is how production chatbot architectures secure public endpoints using SHA-256 HMAC payload signing, origin locks, and edge geo-fencing.

---

1. The Foundation: SHA-256 HMAC Request Signing

Instead of relying on easily forged HTTP headers, HMAC (Hash-based Message Authentication Code) provides cryptographic proof that an incoming request was generated by your authorized widget.

How HMAC Signing Works:

1. Your widget configuration holds a private Signing Secret shared only between Stylchat and your n8n backend.
2. When a visitor sends a message, the request payload is hashed with the secret using SHA-256:

   signature = hmac_sha256(request_body + timestamp, secret)

3. The computed hash is sent in the x-stylchat-signature header along with a timestamp.
4. Your n8n workflow recalculates the hash independently. If the computed hash doesn't match the header, the request is immediately dropped with HTTP 401.

---

2. Verifying HMAC in n8n (Code Node Snippet)

In your n8n workflow, place a Code Node immediately following your Webhook trigger:

const crypto = require('crypto');

const secret = $env.STYLA_SIGNING_SECRET;
const receivedSignature = $input.first().json.headers['x-stylchat-signature'];
const timestamp = $input.first().json.headers['x-stylchat-timestamp'];
const rawBody = JSON.stringify($input.first().json.body);

// 1. Prevent replay attacks (reject timestamps older than 5 minutes)
const now = Math.floor(Date.now() / 1000);
if (Math.abs(now - parseInt(timestamp, 10)) > 300) {
  throw new Error('Request expired: potential replay attack');
}

// 2. Compute expected HMAC SHA-256 signature
const expectedSignature = crypto
  .createHmac('sha256', secret)
  .update(rawBody + timestamp)
  .digest('hex');

// 3. Constant-time comparison to prevent timing attacks
const isValid = crypto.timingSafeEqual(
  Buffer.from(receivedSignature),
  Buffer.from(expectedSignature)
);

if (!isValid) {
  throw new Error('Unauthorized: Invalid HMAC signature');
}

return $input.first();

---

3. Origin Locking & CORS Protection

HMAC ensures payload integrity, but you also need to restrict where the widget is allowed to boot. In the Stylchat Dashboard > Connect & Security tab:

• Allowed Origins: Add strictly the client's production domain (e.g., https://www.clientbrand.com).
• Stylchat's edge layer verifies the HTTP Origin and Referer headers on every widget initialization request. Any unauthorized third party attempting to embed your client's widget on another website is instantly denied.

---

4. Country Geo-Fencing

If your client is a regional dental practice in Texas or a local plumber in Melbourne, there is zero legitimate reason for their chatbot to process incoming traffic from Eastern Europe or Southeast Asia.

With Stylchat's Country Geofencing, you select only the target countries you do business in (e.g., US, CA, GB). Traffic originating outside those geographical borders is filtered at the Cloudflare edge before a single byte reaches your n8n webhook or LLM model.

---

Security Checklist Before Going Live

• [ ] Never commit webhook secrets to public GitHub repositories or client-side bundles.
• [ ] Implement burst rate limiting (e.g., max 5 requests per 10 seconds per IP) to prevent spamming.
• [ ] Enforce replay protection by rejecting expired timestamps.
• [ ] Store your signing secret in n8n environment variables rather than hardcoding in workflow nodes.

By enforcing HMAC signing and edge geo-fencing, your client chatbots become virtually bulletproof against malicious abuse.