Hardened n8n Webhook Security: Rate Limit, HMAC & Slack Alerts

Harden every inbound n8n Webhook with rate limiting, HMAC verification, replay protection, and Slack alerts

This n8n automation adds a hardened security layer to inbound POST webhooks—stopping abusive traffic with per-IP rate limits, verifying authenticity with HMAC-SHA256, blocking replayed requests, validating payloads, and notifying you via Slack when repeated failures occur.

What this workflow does

• Captures raw webhook requests: Receives an inbound POST on an n8n Webhook with raw body capture enabled so signatures can be verified reliably.
• Applies per-IP sliding-window rate limiting: Extracts request metadata (including source IP and headers). If the request exceeds the configured limit, it returns a 429 response.
• Verifies HMAC-SHA256 signatures: Recomputes the signature from the raw body and compares it using a timing-safe comparison.
• Prevents replay attacks: Validates timestamps (with allowed clock skew) and rejects previously seen signature+timestamp pairs.
• Enforces payload rules: Checks required fields, rejects bodies that exceed the configured maximum size, and can optionally block requests outside a configured `IP/CIDR` allow-list.
• Audits every attempt: Writes a structured audit record to a configured HTTP endpoint, then proceeds or rejects based on the aggregated security verdict.
• Slack alerts on repeated failures: Tracks repeated failures per IP; when a threshold is reached, it posts an alert to Slack and returns an appropriate error status.
• Runs your Business Logic only when safe: If security checks pass, it executes your “Business Logic” step and returns 200.

Use cases

• Protecting SaaS endpoints that ingest webhook events (payment, messaging, or event streams).
• Securing internal automations where only specific IP ranges should be allowed.
• Reducing abuse and credential replay risk while maintaining clear audit trails and rapid incident visibility via Slack.

Technical details

• Nodes/logic: webhook, if, set, code, no op, slack, and supporting decision/audit steps.
• Security controls: rate limit (per-IP sliding window), HMAC-SHA256 verification (timing-safe), timestamp skew validation, replay blocking, payload validation, optional IP/CIDR allow-listing.
• Observability: structured audit logging to a configured HTTP endpoint plus Slack alerts.