{"id":43449,"date":"2026-07-19T09:12:45","date_gmt":"2026-07-19T06:12:45","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/"},"modified":"2026-07-19T09:13:29","modified_gmt":"2026-07-19T06:13:29","slug":"proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/","title":{"rendered":"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z"},"content":{"rendered":"<h2>Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z<\/h2>\n<p>G\u00fcn\u00fcm\u00fcz\u00fcn birbirine entegre d\u00fcnyas\u0131nda, uygulamalar aras\u0131 veri al\u0131\u015fveri\u015fi web kancalar\u0131 (webhooks) arac\u0131l\u0131\u011f\u0131yla hayati bir rol oynamaktad\u0131r. \u00d6deme sistemlerinden m\u00fc\u015fteri ili\u015fkileri y\u00f6netimine (CRM) kadar bir\u00e7ok alanda kullan\u0131lan bu otomatik bildirim mekanizmalar\u0131, i\u015f s\u00fcre\u00e7lerinin sorunsuz ak\u0131\u015f\u0131n\u0131 sa\u011flar. Ancak, bu kolayl\u0131k beraberinde \u00f6nemli g\u00fcvenlik risklerini de getirir. \u00d6zellikle bir proxy sunucusunun devreye girdi\u011fi senaryolarda, web kancas\u0131 \u00fczerinden gelen verilerin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve orijinalli\u011fini sa\u011flamak kritik bir hal al\u0131r. Peki, gelen bir web kancas\u0131 bildiriminin ger\u00e7ekten bekledi\u011finiz kaynaktan geldi\u011finden ve yolda hi\u00e7bir de\u011fi\u015fikli\u011fe u\u011framad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? \u0130\u015fte tam bu noktada, web kancas\u0131 imzalar\u0131n\u0131 (webhook signatures) proxy sunucunuz veriyi i\u015flemeden \u00f6nce do\u011frulaman\u0131n \u00f6nemi ortaya \u00e7\u0131kar. Bu makalede, web kancas\u0131 imzalar\u0131n\u0131n ne oldu\u011funu, neden bu kadar \u00f6nemli oldu\u011funu ve proxy sunucular\u0131n\u0131n neden bu do\u011frulama s\u00fcrecini karma\u015f\u0131kla\u015ft\u0131rabilece\u011fini derinlemesine inceleyece\u011fiz.<\/p>\n<h2>Webhook G\u00fcvenli\u011fi Neden Bu Kadar \u00d6nemli?<\/h2>\n<p>Web kancalar\u0131, bir olay (event) meydana geldi\u011finde otomatik olarak belirli bir URL&#8217;ye HTTP POST iste\u011fi g\u00f6nderen kullan\u0131c\u0131 tan\u0131ml\u0131 geri arama (callback) mekanizmalar\u0131d\u0131r. \u00d6rne\u011fin, bir e-ticaret sitesinde yeni bir sipari\u015f verildi\u011finde, \u00f6deme a\u011f ge\u00e7idi bu bilgiyi do\u011frudan sizin sisteminize bir web kancas\u0131 ile g\u00f6nderebilir. Bu, sistemler aras\u0131nda ger\u00e7ek zamanl\u0131 ve verimli bir ileti\u015fim sa\u011flar. Ancak, bu a\u00e7\u0131k ileti\u015fim kanal\u0131, k\u00f6t\u00fc niyetli akt\u00f6rler i\u00e7in potansiyel bir hedef haline gelebilir.<\/p>\n<p>Bir sald\u0131rgan, bir web kancas\u0131 bildirimini ele ge\u00e7irebilir ve i\u00e7eri\u011fini de\u011fi\u015ftirebilir. \u00d6rne\u011fin, bir \u00f6deme bildiriminde sipari\u015f tutar\u0131n\u0131 d\u00fc\u015f\u00fcrebilir veya sipari\u015f durumunu &#8220;\u00f6dendi&#8221; olarak i\u015faretleyebilir, asl\u0131nda \u00f6deme yap\u0131lmam\u0131\u015f olsa bile. Bu t\u00fcr bir manip\u00fclasyon, doland\u0131r\u0131c\u0131l\u0131\u011fa veya ciddi finansal kay\u0131plara yol a\u00e7abilir. Daha da k\u00f6t\u00fcs\u00fc, sald\u0131rganlar kendilerini me\u015fru bir kaynak gibi g\u00f6stererek (spoofing) sahte web kancas\u0131 bildirimleri g\u00f6nderebilirler. Bu sahte bildirimler, sistemlerinizde istenmeyen eylemleri tetikleyebilir, veri taban\u0131n\u0131z\u0131 kirletebilir veya hatta hizmet reddi (Denial of Service &#8211; DoS) sald\u0131r\u0131lar\u0131na zemin haz\u0131rlayabilir. Bu nedenle, bir web kancas\u0131 bildiriminin hem b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc (verinin de\u011fi\u015ftirilmedi\u011fi) hem de orijinalli\u011fini (ger\u00e7ek kaynaktan geldi\u011fi) garanti alt\u0131na almak hayati \u00f6nem ta\u015f\u0131r. Bu g\u00fcvenlik a\u00e7\u0131klar\u0131, \u00f6zellikle finans, sa\u011fl\u0131k ve ki\u015fisel veri i\u015fleyen uygulamalar i\u00e7in kabul edilemez riskler olu\u015fturur.<\/p>\n<p>\u0130\u015fte bu noktada, web kancas\u0131 imzalar\u0131 devreye girer. \u0130mzalar, g\u00f6ndericinin veriyi \u015fifreleyerek veya bir hash (\u00f6zet) olu\u015fturarak, al\u0131c\u0131n\u0131n da bu imzay\u0131 do\u011frulayarak verinin g\u00fcvenli\u011fini sa\u011flamas\u0131na olanak tan\u0131r. Bu sayede, gelen bir bildirimde herhangi bir de\u011fi\u015fiklik yap\u0131l\u0131p yap\u0131lmad\u0131\u011f\u0131 veya bildirim kayna\u011f\u0131n\u0131n ger\u00e7ekten iddia etti\u011fi ki\u015fi olup olmad\u0131\u011f\u0131 kolayca anla\u015f\u0131labilir. Bu temel g\u00fcvenlik katman\u0131 olmadan, web kancas\u0131 tabanl\u0131 entegrasyonlar\u0131n\u0131z, bir sald\u0131rgan\u0131n kolayca manip\u00fcle edebilece\u011fi veya taklit edebilece\u011fi zay\u0131f noktalara sahip olacakt\u0131r. Web kancas\u0131 g\u00fcvenli\u011fine yat\u0131r\u0131m yapmak, sadece verilerinizi korumakla kalmaz, ayn\u0131 zamanda sistemlerinizin genel g\u00fcvenilirli\u011fini ve itibar\u0131n\u0131 da art\u0131r\u0131r. Bu nedenle, her web kancas\u0131 entegrasyonunda imza do\u011frulama mekanizmalar\u0131n\u0131n titizlikle uygulanmas\u0131 bir zorunluluktur.<\/p>\n<h2>Webhook \u0130mzalar\u0131 Nas\u0131l \u00c7al\u0131\u015f\u0131r? Temel Mekanizma<\/h2>\n<p>Webhook imzalar\u0131, g\u00f6nderilen verinin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve kayna\u011f\u0131n\u0131n do\u011frulu\u011funu garanti alt\u0131na almak i\u00e7in kriptografik prensiplere dayan\u0131r. Temel olarak, g\u00f6nderici, payla\u015f\u0131lan bir gizli anahtar (secret key) kullanarak web kancas\u0131 y\u00fck\u00fcn\u00fcn (payload) bir hash&#8217;ini veya karma de\u011ferini olu\u015fturur. Bu hash de\u011feri, genellikle iste\u011fin ba\u015fl\u0131klar\u0131na (headers) bir imza olarak eklenir. Al\u0131c\u0131 taraf ise ayn\u0131 gizli anahtar\u0131 ve gelen y\u00fck\u00fc kullanarak kendi hash de\u011ferini hesaplar ve bu de\u011feri g\u00f6ndericinin sa\u011flad\u0131\u011f\u0131 imza ile kar\u015f\u0131la\u015ft\u0131r\u0131r.<\/p>\n<p>Bu s\u00fcrecin kalbinde, genellikle HMAC (Hash-based Message Authentication Code) ad\u0131 verilen bir mekanizma yatar. HMAC, bir kriptografik hash fonksiyonunu (\u00f6rne\u011fin SHA256) gizli bir anahtarla birle\u015ftirerek mesaj\u0131n kimli\u011fini do\u011frulayan bir kod \u00fcretir. S\u00fcre\u00e7 \u015fu ad\u0131mlarla \u00f6zetlenebilir:<\/p>\n<ol>\n<li><strong>Gizli Anahtar Payla\u015f\u0131m\u0131:<\/strong> G\u00f6nderici ve al\u0131c\u0131, \u00f6nceden g\u00fcvenli bir \u015fekilde payla\u015f\u0131lan, benzersiz ve g\u00fc\u00e7l\u00fc bir gizli anahtar \u00fczerinde anla\u015f\u0131r. Bu anahtar, her iki taraf i\u00e7in de \u00f6zel kalmal\u0131 ve asla if\u015fa edilmemelidir.<\/li>\n<li><strong>\u0130mza Olu\u015fturma (G\u00f6nderici Taraf\u0131nda):<\/strong>\n<ul>\n<li>G\u00f6nderici, web kancas\u0131n\u0131n HTTP iste\u011finin g\u00f6vdesini (body) veya belirli k\u0131s\u0131mlar\u0131n\u0131 (genellikle ham JSON payload&#8217;u) al\u0131r.<\/li>\n<li>Bu ham payload&#8217;u ve payla\u015f\u0131lan gizli anahtar\u0131 kullanarak bir HMAC algoritmas\u0131 (\u00f6rne\u011fin <code>HMAC-SHA256<\/code>) ile bir hash de\u011feri hesaplar.<\/li>\n<li>Ortaya \u00e7\u0131kan hash de\u011ferini (genellikle onalt\u0131l\u0131k (hexadecimal) formatta) iste\u011fin bir HTTP ba\u015fl\u0131\u011f\u0131na (\u00f6rne\u011fin <code>X-Hub-Signature<\/code>, <code>Stripe-Signature<\/code> veya \u00f6zel bir ba\u015fl\u0131k) ekler. Bazen bu imzan\u0131n ba\u015f\u0131na kullan\u0131lan algoritmay\u0131 belirten bir \u00f6nek (\u00f6rne\u011fin <code>sha256=<\/code>) eklenir.<\/li>\n<\/ul>\n<\/li>\n<li><strong>\u0130mza Do\u011frulama (Al\u0131c\u0131 Taraf\u0131nda):<\/strong>\n<ul>\n<li>Al\u0131c\u0131, gelen web kancas\u0131 iste\u011fini al\u0131r.<\/li>\n<li>\u0130ste\u011fin ba\u015fl\u0131klar\u0131ndan g\u00f6ndericinin sa\u011flad\u0131\u011f\u0131 imzay\u0131 (\u00f6rne\u011fin <code>X-Hub-Signature<\/code> ba\u015fl\u0131\u011f\u0131ndaki de\u011feri) \u00e7\u0131kar\u0131r.<\/li>\n<li>\u0130ste\u011fin <strong>ham (raw)<\/strong> g\u00f6vdesini (JSON payload&#8217;unu) al\u0131r. Bu nokta, makalemizin ana odak noktas\u0131d\u0131r: proxy&#8217;ler taraf\u0131ndan de\u011fi\u015ftirilmemi\u015f orijinal hali.<\/li>\n<li>Kendi payla\u015f\u0131lan gizli anahtar\u0131n\u0131 ve ald\u0131\u011f\u0131 ham payload&#8217;u kullanarak, g\u00f6ndericinin kulland\u0131\u011f\u0131 ayn\u0131 HMAC algoritmas\u0131yla (\u00f6rne\u011fin <code>HMAC-SHA256<\/code>) ba\u011f\u0131ms\u0131z olarak bir hash de\u011feri hesaplar.<\/li>\n<li>Kendi hesaplad\u0131\u011f\u0131 hash de\u011ferini, g\u00f6ndericinin sa\u011flad\u0131\u011f\u0131 imza ile kar\u015f\u0131la\u015ft\u0131r\u0131r. E\u011fer iki de\u011fer de tam olarak e\u015fle\u015fiyorsa, verinin b\u00fct\u00fcnl\u00fc\u011f\u00fc korunmu\u015f ve g\u00f6ndericinin kimli\u011fi do\u011frulanm\u0131\u015ft\u0131r. Herhangi bir tutars\u0131zl\u0131k durumunda, iste\u011fin reddedilmesi veya bir g\u00fcvenlik uyar\u0131s\u0131 verilmesi gerekir.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>Bu mekanizma, verinin yolda de\u011fi\u015ftirilmesini veya sahte bir g\u00f6nderici taraf\u0131ndan taklit edilmesini engeller. \u00c7\u00fcnk\u00fc gizli anahtar\u0131 bilmeyen hi\u00e7 kimse, do\u011fru imzay\u0131 \u00fcretemez. Gizli anahtar\u0131n g\u00fcvenli\u011fi, t\u00fcm sistemin g\u00fcvenli\u011fi i\u00e7in kritik \u00f6neme sahiptir. Bu nedenle, anahtarlar\u0131n g\u00fcvenli bir \u015fekilde saklanmas\u0131 ve y\u00f6netilmesi (\u00f6rne\u011fin, ortam de\u011fi\u015fkenleri, anahtar y\u00f6netim hizmetleri veya s\u0131r y\u00f6neticileri arac\u0131l\u0131\u011f\u0131yla) esast\u0131r.<\/p>\n<p>\u00d6rne\u011fin, Python&#8217;da bir HMAC-SHA256 imzas\u0131n\u0131 olu\u015fturmak ve do\u011frulamak i\u00e7in a\u015fa\u011f\u0131daki gibi bir yap\u0131 kullan\u0131labilir:<\/p>\n<div class=\"code-container\">\n<pre><code>\nimport hmac\nimport hashlib\nimport json\n\n# Gizli anahtar (hem g\u00f6nderici hem al\u0131c\u0131 taraf\u0131ndan bilinen)\nSECRET = b\"cok_gizli_anahtariniz_burada\" # Byte dizisi olmal\u0131\n\n# Webhook payload'u (\u00f6rne\u011fin, bir JSON objesi)\npayload_data = {\"event\": \"order.created\", \"data\": {\"order_id\": \"12345\", \"amount\": 100.0}}\n# Payload'u ham JSON string'ine d\u00f6n\u00fc\u015ft\u00fcr\u00fcn\n# \u00d6NEML\u0130: G\u00f6nderici ve al\u0131c\u0131 ayn\u0131 string'i kullanmal\u0131.\n# Genellikle s\u0131ral\u0131 anahtarlar ve kompakt format (ayr\u0131nt\u0131s\u0131z) tercih edilir.\nraw_payload = json.dumps(payload_data, separators=(',', ':')).encode('utf-8')\n\n# \u0130mza olu\u015fturma (G\u00f6nderici taraf\u0131)\ndef generate_signature(secret, payload):\n    h = hmac.new(secret, payload, hashlib.sha256)\n    return h.hexdigest()\n\nsignature_generated = generate_signature(SECRET, raw_payload)\nprint(f\"Olu\u015fturulan \u0130mza: {signature_generated}\")\n\n# \u0130mza do\u011frulama (Al\u0131c\u0131 taraf\u0131)\ndef verify_signature(secret, payload, received_signature):\n    expected_signature = generate_signature(secret, payload)\n    # Zamanlama sald\u0131r\u0131lar\u0131na kar\u015f\u0131 g\u00fcvenli kar\u015f\u0131la\u015ft\u0131rma\n    return hmac.compare_digest(expected_signature, received_signature)\n\n# Al\u0131c\u0131 taraf\u0131na gelen payload ve imza\nreceived_payload = raw_payload # Normalde HTTP iste\u011finden okunur\nreceived_signature_from_header = signature_generated # Normalde HTTP ba\u015fl\u0131\u011f\u0131ndan okunur\n\nif verify_signature(SECRET, received_payload, received_signature_from_header):\n    print(\"\u0130mza do\u011fruland\u0131: Webhook ge\u00e7erli ve g\u00fcvenli.\")\nelse:\n    print(\"\u0130mza do\u011frulanamad\u0131: Webhook ge\u00e7ersiz veya kurcalanm\u0131\u015f olabilir!\")\n      <\/code><\/pre>\n<\/p><\/div>\n<p>Yukar\u0131daki \u00f6rnekte, <code>json.dumps(payload_data, separators=(',', ':')).encode('utf-8')<\/code> k\u0131sm\u0131na \u00f6zellikle dikkat edin. JSON string&#8217;inin olu\u015fturulma \u015fekli, imza hesaplamas\u0131 i\u00e7in kritik \u00f6neme sahiptir. Bo\u015fluklar, yeni sat\u0131rlar veya anahtar s\u0131ralamas\u0131 gibi k\u00fc\u00e7\u00fck farkl\u0131l\u0131klar bile farkl\u0131 bir imza olu\u015fturulmas\u0131na neden olabilir. Bu nedenle, hem g\u00f6nderici hem de al\u0131c\u0131 taraf\u0131n, imza olu\u015fturmak i\u00e7in ayn\u0131 JSON serile\u015ftirme kurallar\u0131n\u0131 uygulamas\u0131 zorunludur.<\/p>\n<h2>Proxy Sunucular\u0131 ve JSON Manip\u00fclasyonu Riski: Tehlike Nerede Ba\u015fl\u0131yor?<\/h2>\n<p>Modern uygulama mimarilerinde, proxy sunucular\u0131 (veya API Gateway&#8217;ler, ters proxy&#8217;ler) yayg\u0131n olarak kullan\u0131l\u0131r. Bu sunucular, gelen istekleri arka u\u00e7 hizmetlerine y\u00f6nlendirmeden \u00f6nce \u00e7e\u015fitli g\u00f6revleri yerine getirir: y\u00fck dengeleme (load balancing), \u00f6nbellekleme (caching), trafik filtreleme, g\u00fcvenlik duvar\u0131 i\u015flevleri, kimlik do\u011frulama\/yetkilendirme ve hatta istek\/yan\u0131t g\u00f6vdelerinin d\u00f6n\u00fc\u015ft\u00fcr\u00fclmesi. Bu i\u015flevler, performans\u0131 ve g\u00fcvenli\u011fi art\u0131rabilirken, web kancas\u0131 imza do\u011frulama s\u00fcreci i\u00e7in beklenmedik sorunlara yol a\u00e7abilirler.<\/p>\n<p>Tehlike, proxy sunucusunun gelen web kancas\u0131 iste\u011finin JSON g\u00f6vdesini (payload) de\u011fi\u015ftirmesiyle ba\u015flar. Bu de\u011fi\u015fiklikler kas\u0131tl\u0131 veya kas\u0131ts\u0131z olabilir:<\/p>\n<ul>\n<li><strong>JSON Format\u0131n\u0131n Yeniden Bi\u00e7imlendirilmesi (Reformatting):<\/strong> Bir proxy, gelen JSON y\u00fck\u00fcn\u00fc daha okunabilir hale getirmek i\u00e7in bo\u015fluklar, yeni sat\u0131rlar veya sekmeler ekleyebilir (pretty-printing). Veya tam tersi, bant geni\u015fli\u011fini optimize etmek i\u00e7in t\u00fcm bo\u015fluklar\u0131 kald\u0131rabilir (minifying).<\/li>\n<li><strong>Anahtar S\u0131ralamas\u0131n\u0131n De\u011fi\u015fmesi:<\/strong> JSON standartlar\u0131, nesnelerdeki anahtarlar\u0131n belirli bir s\u0131raya sahip olmas\u0131n\u0131 zorunlu k\u0131lmaz. Baz\u0131 proxy&#8217;ler veya JSON i\u015flemcileri, anahtarlar\u0131 alfabetik s\u0131raya g\u00f6re yeniden d\u00fczenleyebilir.<\/li>\n<li><strong>Veri Tipi D\u00f6n\u00fc\u015f\u00fcmleri:<\/strong> Baz\u0131 proxy&#8217;ler, say\u0131sal de\u011ferleri string&#8217;e veya string&#8217;den say\u0131ya d\u00f6n\u00fc\u015ft\u00fcrebilir. \u00d6rne\u011fin, bir ID numaras\u0131 JSON&#8217;da say\u0131 olarak g\u00f6r\u00fcnse de, proxy bunu bir string olarak i\u015fleyip yeniden serile\u015ftirebilir.<\/li>\n<li><strong>Ek Alanlar veya Ba\u015fl\u0131klar Ekleme:<\/strong> Proxy, izleme (tracing) bilgileri, g\u00fcvenlik damgalar\u0131 veya di\u011fer meta verileri JSON y\u00fck\u00fcne ekleyebilir veya HTTP ba\u015fl\u0131klar\u0131na ekleyip, orijinal payload&#8217;u de\u011fi\u015ftirebilir.<\/li>\n<li><strong>Karakter Kodlama Sorunlar\u0131:<\/strong> Proxy&#8217;nin farkl\u0131 bir karakter kodlamas\u0131 (\u00f6rne\u011fin UTF-8 yerine ISO-8859-1) kullanmas\u0131, payload&#8217;un byte dizisini de\u011fi\u015ftirebilir.<\/li>\n<\/ul>\n<p>Bu de\u011fi\u015fikliklerin her biri, g\u00f6ndericinin orijinal olarak imzalad\u0131\u011f\u0131 ham JSON y\u00fck\u00fcnden farkl\u0131 bir JSON y\u00fck\u00fc ortaya \u00e7\u0131kar\u0131r. Hat\u0131rlayaca\u011f\u0131n\u0131z \u00fczere, imza do\u011frulama s\u00fcrecinde al\u0131c\u0131, gelen ham payload&#8217;u kullanarak kendi imzas\u0131n\u0131 hesaplar ve bunu g\u00f6ndericinin sa\u011flad\u0131\u011f\u0131 imza ile kar\u015f\u0131la\u015ft\u0131r\u0131r. E\u011fer proxy, al\u0131c\u0131ya ula\u015fmadan \u00f6nce payload&#8217;u de\u011fi\u015ftirirse, al\u0131c\u0131n\u0131n kendi hesaplad\u0131\u011f\u0131 imza, g\u00f6ndericinin orijinal imzas\u0131ndan farkl\u0131 olacakt\u0131r. Bu durumda, me\u015fru bir web kancas\u0131 bile &#8220;ge\u00e7ersiz imza&#8221; hatas\u0131yla reddedilecektir. Bu durum, yanl\u0131\u015f pozitif (false positive) olarak adland\u0131r\u0131l\u0131r ve sistemler aras\u0131nda g\u00fcveni zedeleyebilir, i\u015f s\u00fcre\u00e7lerini aksatabilir ve hata ay\u0131klamay\u0131 (debugging) son derece zorla\u015ft\u0131rabilir.<\/p>\n<p><strong>Ger\u00e7ek D\u00fcnya Senaryosu:<\/strong> Bir \u00f6deme a\u011f ge\u00e7idinden gelen &#8220;\u00f6deme ba\u015far\u0131l\u0131&#8221; web kancas\u0131n\u0131 d\u00fc\u015f\u00fcn\u00fcn. Bu web kancas\u0131, sizin API Gateway&#8217;inize (bir t\u00fcr proxy) ula\u015f\u0131r. API Gateway, gelen iste\u011fi loglamak, baz\u0131 g\u00fcvenlik kontrollerinden ge\u00e7irmek ve ard\u0131ndan uygulaman\u0131z\u0131n arka ucuna iletmek \u00fczere yap\u0131land\u0131r\u0131lm\u0131\u015ft\u0131r. Ancak, bu s\u00fcre\u00e7te API Gateway, JSON y\u00fck\u00fcn\u00fc &#8220;g\u00fczelce bi\u00e7imlendirebilir&#8221; veya baz\u0131 meta verileri ekleyebilir. Uygulaman\u0131z\u0131n arka ucu bu de\u011fi\u015ftirilmi\u015f JSON y\u00fck\u00fcn\u00fc ald\u0131\u011f\u0131nda, imza do\u011frulama i\u00e7in kullan\u0131r. Ancak, \u00f6deme a\u011f ge\u00e7idi orijinal, bo\u015fluksuz JSON y\u00fck\u00fcn\u00fc imzalad\u0131\u011f\u0131 i\u00e7in, sizin arka ucunuzun hesaplad\u0131\u011f\u0131 imza e\u015fle\u015fmeyecektir. Sonu\u00e7 olarak, ge\u00e7erli bir \u00f6deme bildirimi reddedilecek ve m\u00fc\u015fterinin sipari\u015fi i\u015flenmeyecektir. Bu da hem m\u00fc\u015fteri memnuniyetsizli\u011fine hem de manuel m\u00fcdahale gerektiren operasyonel bir y\u00fcke neden olur.<\/p>\n<p>Bu nedenle, web kancas\u0131 imzalar\u0131n\u0131 do\u011frulaman\u0131n en g\u00fcvenli ve do\u011fru yolu, iste\u011fin <strong>ham (raw)<\/strong> ve <strong>de\u011fi\u015ftirilmemi\u015f<\/strong> JSON g\u00f6vdesi \u00fczerinde yapmakt\u0131r. Bu da demektir ki, imza do\u011frulama mant\u0131\u011f\u0131, proxy sunucusu herhangi bir JSON manip\u00fclasyonu yapmadan \u00f6nce \u00e7al\u0131\u015ft\u0131r\u0131lmal\u0131d\u0131r. \u0130deal olarak, proxy&#8217;nin kendisi bu do\u011frulamay\u0131 yapmal\u0131 veya iste\u011fi arka uca iletmeden \u00f6nce ham payload&#8217;a eri\u015fimi garanti etmelidir. Aksi takdirde, proxy&#8217;nin neden oldu\u011fu formatlama farkl\u0131l\u0131klar\u0131, ge\u00e7erli web kancalar\u0131n\u0131 bile ge\u00e7ersiz k\u0131larak sistemlerinizde ciddi aksakl\u0131klara yol a\u00e7abilir.<\/p>\n<h2>\u0130mza Do\u011frulama S\u00fcreci: Ad\u0131m Ad\u0131m G\u00fcvenli Entegrasyon<\/h2>\n<p>Webhook imzalar\u0131n\u0131 g\u00fcvenli bir \u015fekilde do\u011frulamak, sistemlerinizin d\u0131\u015f kaynaklardan gelen verilere g\u00fcvenmesini sa\u011flaman\u0131n temelidir. Bu s\u00fcre\u00e7, dikkatli bir uygulama gerektirir ve \u00f6zellikle bir proxy sunucusunun oldu\u011fu ortamlarda do\u011fru ad\u0131mlar\u0131n izlenmesi hayati \u00f6nem ta\u015f\u0131r. \u0130\u015fte ad\u0131m ad\u0131m g\u00fcvenli imza do\u011frulama s\u00fcreci:<\/p>\n<ol>\n<li><strong>Ham (Raw) HTTP \u0130ste\u011fini Yakalama:<\/strong>\n<p>Webhook iste\u011fi sisteminize ula\u015ft\u0131\u011f\u0131nda, ilk ve en kritik ad\u0131m, HTTP iste\u011finin <strong>ham g\u00f6vdesini<\/strong> (raw request body) yakalamakt\u0131r. Bu, hi\u00e7bir ara yaz\u0131l\u0131m\u0131n (middleware), proxy&#8217;nin veya framework&#8217;\u00fcn JSON&#8217;u ayr\u0131\u015ft\u0131rmadan (parse etmeden) veya de\u011fi\u015ftirmeden \u00f6nceki orijinal halidir. \u00c7o\u011fu web framework&#8217;\u00fc, bu ham g\u00f6vdeye eri\u015fim sa\u011flar. \u00d6rne\u011fin, Node.js&#8217;de Express kullan\u0131rken <code>req.rawBody<\/code> veya benzeri bir mekanizma ile buna eri\u015febilirsiniz. Python&#8217;da Flask kullan\u0131rken <code>request.get_data()<\/code> veya Django&#8217;da <code>request.body<\/code> ile ham i\u00e7eri\u011fe ula\u015f\u0131labilir.<\/p>\n<\/li>\n<li><strong>\u0130mza Ba\u015fl\u0131\u011f\u0131n\u0131 \u00c7\u0131karma:<\/strong>\n<p>G\u00f6nderici, imzay\u0131 genellikle HTTP ba\u015fl\u0131klar\u0131ndan birinde g\u00f6nderir. Bu ba\u015fl\u0131\u011f\u0131n ad\u0131, webhook sa\u011flay\u0131c\u0131s\u0131na g\u00f6re de\u011fi\u015fir (\u00f6rne\u011fin, Stripe i\u00e7in <code>Stripe-Signature<\/code>, GitHub i\u00e7in <code>X-Hub-Signature<\/code>, Shopify i\u00e7in <code>X-Shopify-Hmac-Sha256<\/code>). \u0130lgili ba\u015fl\u0131\u011f\u0131 okuyun ve i\u00e7indeki imza de\u011ferini al\u0131n. Bu ba\u015fl\u0131k, bazen imzan\u0131n yan\u0131 s\u0131ra zaman damgas\u0131 (timestamp) gibi ek bilgiler de i\u00e7erebilir; bu durumda, sadece imza k\u0131sm\u0131n\u0131 ayr\u0131\u015ft\u0131rman\u0131z gerekir.<\/p>\n<\/li>\n<li><strong>Payla\u015f\u0131lan Gizli Anahtar\u0131 G\u00fcvenli Bir \u015eekilde Al\u0131n:<\/strong>\n<p>Daha \u00f6nce g\u00f6nderici ile payla\u015ft\u0131\u011f\u0131n\u0131z gizli anahtar\u0131 (secret key) g\u00fcvenli bir depolama alan\u0131ndan (ortam de\u011fi\u015fkenleri, s\u0131r y\u00f6neticileri gibi) al\u0131n. Bu anahtar\u0131n kodunuzda sabit kodlanmamas\u0131na (hardcode) ve versiyon kontrol sistemlerine (Git gibi) yanl\u0131\u015fl\u0131kla g\u00f6nderilmemesine dikkat edin.<\/p>\n<\/li>\n<li><strong>Kendi \u0130mzan\u0131z\u0131 Hesaplama:<\/strong>\n<p>Ald\u0131\u011f\u0131n\u0131z ham HTTP g\u00f6vdesini (1. ad\u0131mdan) ve payla\u015f\u0131lan gizli anahtar\u0131 (3. ad\u0131mdan) kullanarak, g\u00f6ndericinin kulland\u0131\u011f\u0131 ayn\u0131 kriptografik hash algoritmas\u0131yla (\u00f6rne\u011fin <code>HMAC-SHA256<\/code>) kendi imzan\u0131z\u0131 hesaplay\u0131n. Bu ad\u0131mda, g\u00f6ndericinin JSON&#8217;u nas\u0131l serile\u015ftirdi\u011fini (\u00f6rne\u011fin, anahtar s\u0131ralamas\u0131, bo\u015fluklar) tam olarak taklit etmeniz \u00e7ok \u00f6nemlidir. \u00c7o\u011fu zaman, ham payload&#8217;u do\u011frudan byte dizisi olarak kullanmak en g\u00fcvenli yoldur.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# \u00d6rnek Python kodu:\nimport hmac\nimport hashlib\n\ndef calculate_signature(secret: str, payload_bytes: bytes, algorithm: str = 'sha256') -> str:\n    # Secret string'i byte'a d\u00f6n\u00fc\u015ft\u00fcr\n    secret_bytes = secret.encode('utf-8')\n    # HMAC objesi olu\u015ftur\n    if algorithm == 'sha256':\n        h = hmac.new(secret_bytes, payload_bytes, hashlib.sha256)\n    elif algorithm == 'sha1': # Baz\u0131 eski sistemler SHA1 kullanabilir\n        h = hmac.new(secret_bytes, payload_bytes, hashlib.sha1)\n    else:\n        raise ValueError(f\"Desteklenmeyen algoritma: {algorithm}\")\n    return h.hexdigest()\n\n# Kullan\u0131m \u00f6rne\u011fi (varsay\u0131msal)\n# raw_body_from_request = request.get_data() # Flask'tan ham body\n# shared_secret_key = os.environ.get(\"WEBHOOK_SECRET\")\n# expected_signature = calculate_signature(shared_secret_key, raw_body_from_request, 'sha256')\n              <\/code><\/pre>\n<\/p><\/div>\n<\/li>\n<li><strong>\u0130mzalar\u0131 Kar\u015f\u0131la\u015ft\u0131rma:<\/strong>\n<p>Kendi hesaplad\u0131\u011f\u0131n\u0131z imza ile (4. ad\u0131mdan) g\u00f6ndericinin sa\u011flad\u0131\u011f\u0131 imzay\u0131 (2. ad\u0131mdan) kar\u015f\u0131la\u015ft\u0131r\u0131n. Bu kar\u015f\u0131la\u015ft\u0131rmay\u0131, zamanlama sald\u0131r\u0131lar\u0131na (timing attacks) kar\u015f\u0131 g\u00fcvenli bir \u015fekilde yapmak \u00f6nemlidir. Python&#8217;daki <code>hmac.compare_digest()<\/code> gibi fonksiyonlar bu ama\u00e7 i\u00e7in tasarlanm\u0131\u015ft\u0131r.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# \u00d6rnek Python kodu:\nimport hmac\n\ndef verify_webhook_signature(secret: str, raw_payload_bytes: bytes, received_signature: str, algorithm: str = 'sha256') -> bool:\n    calculated_signature = calculate_signature(secret, raw_payload_bytes, algorithm)\n    # G\u00fcvenli kar\u015f\u0131la\u015ft\u0131rma\n    return hmac.compare_digest(calculated_signature, received_signature)\n\n# Kullan\u0131m \u00f6rne\u011fi (varsay\u0131msal)\n# if verify_webhook_signature(shared_secret_key, raw_body_from_request, received_signature_header_value, 'sha256'):\n#     print(\"Webhook imzas\u0131 do\u011fruland\u0131.\")\n# else:\n#     print(\"Webhook imzas\u0131 ge\u00e7ersiz!\")\n              <\/code><\/pre>\n<\/p><\/div>\n<\/li>\n<li><strong>Sonu\u00e7 ve Hata Y\u00f6netimi:<\/strong>\n<p>E\u011fer imzalar e\u015fle\u015firse, iste\u011fin ge\u00e7erli ve g\u00fcvenli oldu\u011funu varsayabilirsiniz. JSON payload&#8217;unu g\u00fcvenle ayr\u0131\u015ft\u0131rabilir ve i\u015fleyebilirsiniz. E\u011fer e\u015fle\u015fmezse, iste\u011fi reddetmeli, bir hata g\u00fcnl\u00fc\u011f\u00fc (log) kayd\u0131 olu\u015fturmal\u0131 ve potansiyel bir g\u00fcvenlik ihlali veya yap\u0131land\u0131rma hatas\u0131 hakk\u0131nda uyar\u0131 vermelisiniz. Asla ge\u00e7ersiz imzal\u0131 bir iste\u011fi i\u015flemeyin.<\/p>\n<\/li>\n<\/ol>\n<p>Bu ad\u0131mlar\u0131 uygularken, \u00f6zellikle &#8220;ham HTTP iste\u011fini yakalama&#8221; k\u0131sm\u0131, proxy&#8217;ler ve API Gateway&#8217;ler gibi ara katmanlar\u0131n oldu\u011fu ortamlarda daha da kritik hale gelir. Do\u011frulama, JSON manip\u00fclasyonu yapabilecek herhangi bir bile\u015fenden \u00f6nce ger\u00e7ekle\u015fmelidir. Bu, ya proxy&#8217;nin kendisinin bu do\u011frulamay\u0131 yapmas\u0131 ya da ham iste\u011fi de\u011fi\u015ftirmeden uygulaman\u0131za iletmesi gerekti\u011fi anlam\u0131na gelir.<\/p>\n<h3>Farkl\u0131 Platformlarda Webhook \u0130mza Do\u011frulama \u00d6rnekleri<\/h3>\n<p>Webhook sa\u011flay\u0131c\u0131lar\u0131, imza do\u011frulama mekanizmalar\u0131nda benzer prensipleri kullan\u0131r ancak baz\u0131 k\u00fc\u00e7\u00fck farkl\u0131l\u0131klar g\u00f6sterebilirler. Bu farkl\u0131l\u0131klar genellikle kullan\u0131lan hash algoritmas\u0131, imza ba\u015fl\u0131\u011f\u0131n\u0131n ad\u0131 ve imza format\u0131nda kendini g\u00f6sterir. \u0130\u015fte birka\u00e7 pop\u00fcler platformdan \u00f6rnekler:<\/p>\n<ul>\n<li><strong>Stripe:<\/strong> Stripe, web kancas\u0131 imzalar\u0131n\u0131 do\u011frulamak i\u00e7in <code>Stripe-Signature<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 kullan\u0131r. Bu ba\u015fl\u0131k, bir zaman damgas\u0131 (<code>t=<\/code>) ve bir veya daha fazla imza (<code>v1=<\/code>, <code>v0=<\/code>) i\u00e7erir. Stripe, zaman damgas\u0131n\u0131n ve payload&#8217;un birle\u015ftirilmi\u015f halini HMAC-SHA256 kullanarak imzalar. Bu, tekrar oynatma sald\u0131r\u0131lar\u0131n\u0131 (replay attacks) \u00f6nlemek i\u00e7in zaman damgas\u0131n\u0131 da do\u011frulamay\u0131 gerektirir.<\/li>\n<li><strong>GitHub:<\/strong> GitHub, <code>X-Hub-Signature<\/code> veya <code>X-Hub-Signature-256<\/code> ba\u015fl\u0131klar\u0131n\u0131 kullan\u0131r. Genellikle <code>HMAC-SHA1<\/code> veya <code>HMAC-SHA256<\/code> algoritmalar\u0131n\u0131 destekler. \u0130mza, iste\u011fin ham g\u00f6vdesi ve payla\u015f\u0131lan gizli anahtar kullan\u0131larak hesaplan\u0131r.<\/li>\n<li><strong>Shopify: Bir e-ticaret platformu olan Shopify, <code>X-Shopify-Hmac-Sha256<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 kullan\u0131r ve imzay\u0131 HMAC-SHA256 ile hesaplar. Yine, iste\u011fin ham g\u00f6vdesi kullan\u0131l\u0131r ve imza do\u011frulamas\u0131 i\u00e7in bu ham g\u00f6vdenin kullan\u0131lmas\u0131 elzemdir.<\/code><\/li>\n<\/ul>\n<p>Bu platformlar\u0131n her biri, kendi dok\u00fcmantasyonlar\u0131nda imza do\u011frulama i\u00e7in ayr\u0131nt\u0131l\u0131 rehberler ve bazen \u00f6rnek kodlar sunar. Entegrasyon yaparken, ilgili platformun spesifik gereksinimlerini dikkatlice incelemek ve uygulamak \u00f6nemlidir. Temel prensip ayn\u0131 kalsa da, k\u00fc\u00e7\u00fck detaylar do\u011fru do\u011frulama i\u00e7in hayati \u00f6nem ta\u015f\u0131r.<\/p>\n<h2>Geli\u015fmi\u015f G\u00fcvenlik \u0130pu\u00e7lar\u0131 ve En \u0130yi Uygulamalar<\/h2>\n<p>Webhook imza do\u011frulamas\u0131, web kancas\u0131 g\u00fcvenli\u011finin temelini olu\u015fturur, ancak bu tek ba\u015f\u0131na yeterli de\u011fildir. Daha sa\u011flam bir g\u00fcvenlik duru\u015fu i\u00e7in ek \u00f6nlemler ve en iyi uygulamalar g\u00f6z \u00f6n\u00fcnde bulundurulmal\u0131d\u0131r. \u0130\u015fte ileri d\u00fczey g\u00fcvenlik ipu\u00e7lar\u0131:<\/p>\n<ul>\n<li><strong>Tekrar Oynatma Sald\u0131r\u0131lar\u0131na (Replay Attacks) Kar\u015f\u0131 Koruma:<\/strong>\n<p>Bir sald\u0131rgan, ge\u00e7erli bir web kancas\u0131 iste\u011fini kaydedip daha sonra tekrar g\u00f6nderebilir. Bu, sisteminizde istenmeyen \u00e7ift i\u015flem (duplicate processing) veya di\u011fer tutars\u0131zl\u0131klara yol a\u00e7abilir. Bu t\u00fcr sald\u0131r\u0131lar\u0131 \u00f6nlemek i\u00e7in:<\/p>\n<ul>\n<li><strong>Zaman Damgalar\u0131 (Timestamps):<\/strong> Bir\u00e7ok webhook sa\u011flay\u0131c\u0131s\u0131, imzayla birlikte bir zaman damgas\u0131 g\u00f6nderir (\u00f6rne\u011fin, Stripe&#8217;\u0131n <code>Stripe-Signature<\/code> ba\u015fl\u0131\u011f\u0131ndaki <code>t=<\/code> de\u011feri). Bu zaman damgas\u0131n\u0131n, iste\u011fin al\u0131nd\u0131\u011f\u0131 zamana g\u00f6re belirli bir tolerans (\u00f6rne\u011fin, 5 dakika) i\u00e7inde olup olmad\u0131\u011f\u0131n\u0131 kontrol edin. \u00c7ok eski veya \u00e7ok gelecekteki zaman damgalar\u0131na sahip istekleri reddedin.<\/li>\n<li><strong>Nonce (Kullan\u0131m Ba\u015f\u0131na Say\u0131):<\/strong> Baz\u0131 sistemler, her istek i\u00e7in benzersiz bir &#8220;nonce&#8221; de\u011feri kullan\u0131r. Bu de\u011feri bir veritaban\u0131nda saklayarak, ayn\u0131 nonce ile gelen tekrar eden istekleri tespit edip reddedebilirsiniz. Ancak bu, veritaban\u0131 y\u00fck\u00fcn\u00fc art\u0131rabilir ve da\u011f\u0131t\u0131k sistemlerde senkronizasyon sorunlar\u0131 yaratabilir.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Gizli Anahtar Y\u00f6netimi ve Rotasyonu:<\/strong>\n<p>Gizli anahtarlar\u0131n\u0131z, sistemlerinizin en de\u011ferli s\u0131rlar\u0131ndan biridir. Bunlar\u0131 asla kod taban\u0131nda (codebase) veya versiyon kontrol\u00fcnde saklamay\u0131n. Ortam de\u011fi\u015fkenleri, AWS Secrets Manager, Azure Key Vault veya HashiCorp Vault gibi s\u0131r y\u00f6netim \u00e7\u00f6z\u00fcmleri kullan\u0131n. Ayr\u0131ca, gizli anahtarlar\u0131 d\u00fczenli aral\u0131klarla (\u00f6rne\u011fin, 90 g\u00fcnde bir) veya bir g\u00fcvenlik olay\u0131 \u015f\u00fcphesi durumunda de\u011fi\u015ftirmek (rotate etmek) iyi bir uygulamad\u0131r. Bir anahtar rotasyonu s\u0131ras\u0131nda, hem eski hem de yeni anahtar\u0131 bir s\u00fcre desteklemeniz gerekebilir.<\/p>\n<\/li>\n<li><strong>IP Beyaz Listeleme (IP Whitelisting):<\/strong>\n<p>Webhook isteklerinin sadece bilinen ve g\u00fcvenilir IP adreslerinden gelmesini sa\u011flamak i\u00e7in bir IP beyaz listesi kullanabilirsiniz. Webhook sa\u011flay\u0131c\u0131n\u0131z\u0131n belgelerinde, bildirimleri g\u00f6nderdi\u011fi IP aral\u0131klar\u0131 genellikle belirtilir. G\u00fcvenlik duvar\u0131n\u0131z\u0131 veya API Gateway&#8217;inizi bu IP&#8217;lerden gelmeyen istekleri engellemek \u00fczere yap\u0131land\u0131r\u0131n. Bu, imza do\u011frulamas\u0131na ek bir g\u00fcvenlik katman\u0131 sa\u011flar.<\/p>\n<\/li>\n<li><strong>\u0130\u015fleme Zaman A\u015f\u0131mlar\u0131 ve Tekrar Denemeler:<\/strong>\n<p>Webhook i\u015fleyicinizin, iste\u011fi belirli bir s\u00fcre i\u00e7inde yan\u0131tlamas\u0131 \u00f6nemlidir. Uzun s\u00fcren i\u015flemler, webhook sa\u011flay\u0131c\u0131s\u0131n\u0131n iste\u011fi zaman a\u015f\u0131m\u0131na u\u011fratmas\u0131na ve tekrar g\u00f6ndermesine neden olabilir. Bu da, tekrar oynatma sald\u0131r\u0131s\u0131 olmasa bile \u00e7ift i\u015flem riskini art\u0131r\u0131r. H\u0131zl\u0131 yan\u0131t verin ve uzun s\u00fcren i\u015flemleri bir mesaj kuyru\u011funa (message queue) veya arka plan i\u015fleme sistemine devredin. Webhook sa\u011flay\u0131c\u0131n\u0131z\u0131n tekrar deneme (retry) politikalar\u0131n\u0131 anlay\u0131n ve buna uygun bir \u015fekilde idempotent (ayn\u0131 i\u015flemi birden fazla kez g\u00fcvenle y\u00fcr\u00fctebilen) i\u015fleyiciler tasarlay\u0131n.<\/p>\n<\/li>\n<li><strong>Detayl\u0131 G\u00fcnl\u00fckleme (Logging) ve \u0130zleme (Monitoring):<\/strong>\n<p>T\u00fcm gelen webhook isteklerini, imza do\u011frulama sonu\u00e7lar\u0131n\u0131 (ba\u015far\u0131l\u0131\/ba\u015far\u0131s\u0131z), zaman damgas\u0131 kontrollerini ve olas\u0131 hatalar\u0131 ayr\u0131nt\u0131l\u0131 bir \u015fekilde g\u00fcnl\u00fc\u011fe kaydedin. Anormal say\u0131da ba\u015far\u0131s\u0131z imza do\u011frulamas\u0131 veya \u015f\u00fcpheli kaynaklardan gelen istekler i\u00e7in uyar\u0131lar (alerts) kurun. Bu, potansiyel g\u00fcvenlik sorunlar\u0131n\u0131 h\u0131zla tespit etmenize ve yan\u0131t vermenize yard\u0131mc\u0131 olur.<\/p>\n<\/li>\n<li><strong>Sadece \u0130htiya\u00e7 Duyulan Verileri A\u00e7\u0131\u011fa \u00c7\u0131karma:<\/strong>\n<p>Webhook&#8217;lar arac\u0131l\u0131\u011f\u0131yla g\u00f6nderilen verilerin hassasiyetini de\u011ferlendirin. M\u00fcmk\u00fcnse, sadece ger\u00e7ekten gerekli olan minimum veri miktar\u0131n\u0131 g\u00f6nderin. Hassas ki\u015fisel veya finansal bilgileri do\u011frudan webhook payload&#8217;unda g\u00f6ndermekten ka\u00e7\u0131n\u0131n; bunun yerine, bir ID g\u00f6nderip al\u0131c\u0131n\u0131n g\u00fcvenli bir API \u00e7a\u011fr\u0131s\u0131 ile ilgili detaylar\u0131 \u00e7ekmesini sa\u011flay\u0131n.<\/p>\n<\/li>\n<\/ul>\n<p>Bu geli\u015fmi\u015f uygulamalar\u0131 bir araya getirerek, web kancas\u0131 entegrasyonlar\u0131n\u0131z\u0131n yaln\u0131zca i\u015flevsel de\u011fil, ayn\u0131 zamanda son derece g\u00fcvenli olmas\u0131n\u0131 sa\u011flayabilirsiniz. G\u00fcvenlik, s\u00fcrekli bir s\u00fcre\u00e7tir ve bu ipu\u00e7lar\u0131, sistemlerinizi g\u00fcncel tehditlere kar\u015f\u0131 daha diren\u00e7li hale getirecektir.<\/p>\n<h2>Ger\u00e7ek D\u00fcnya Senaryosu: E-ticaret Platformunda G\u00fcvenli Webhook Y\u00f6netimi<\/h2>\n<p>Bir e-ticaret platformu i\u015fletti\u011finizi ve \u00f6deme i\u015flemleriniz i\u00e7in Stripe gibi bir \u00fc\u00e7\u00fcnc\u00fc taraf \u00f6deme a\u011f ge\u00e7idi kulland\u0131\u011f\u0131n\u0131z\u0131 varsayal\u0131m. M\u00fc\u015fterileriniz bir sipari\u015f verdi\u011finde, \u00f6deme a\u011f ge\u00e7idi \u00f6deme durumunu (ba\u015far\u0131l\u0131, ba\u015far\u0131s\u0131z, iade edildi vb.) sizin sisteminize web kancalar\u0131 arac\u0131l\u0131\u011f\u0131yla bildirir. Bu bildirimler, sipari\u015f durumunu g\u00fcncellemek, fatura olu\u015fturmak ve m\u00fc\u015fteriye e-posta g\u00f6ndermek gibi kritik i\u015f ak\u0131\u015flar\u0131n\u0131 tetikler. Sistem mimariniz, gelen t\u00fcm API isteklerini bir API Gateway (bir t\u00fcr proxy) \u00fczerinden ge\u00e7irecek \u015fekilde tasarlanm\u0131\u015ft\u0131r.<\/p>\n<p><strong>Sorun: Proxy&#8217;nin Yol A\u00e7t\u0131\u011f\u0131 G\u00fcvenlik A\u00e7\u0131\u011f\u0131<\/strong><\/p>\n<p>API Gateway&#8217;iniz, gelen istekleri loglamak ve baz\u0131 temel d\u00f6n\u00fc\u015f\u00fcmler yapmak \u00fczere yap\u0131land\u0131r\u0131lm\u0131\u015ft\u0131r. \u00d6rne\u011fin, Stripe&#8217;dan gelen ham JSON payload&#8217;unu al\u0131p, uygulaman\u0131z\u0131n arka ucuna iletmeden \u00f6nce daha okunabilir bir formata d\u00f6n\u00fc\u015ft\u00fcr\u00fcyor (pretty-printing) veya baz\u0131 gereksiz oldu\u011funu d\u00fc\u015f\u00fcnd\u00fc\u011f\u00fc bo\u015fluklar\u0131 kald\u0131r\u0131yor. Stripe ise bu web kancas\u0131 bildirimini, orijinal, s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f (minified) JSON payload&#8217;u \u00fczerinden bir HMAC-SHA256 imzas\u0131 ile g\u00f6ndermi\u015ftir. \u0130mza ba\u015fl\u0131\u011f\u0131 <code>Stripe-Signature<\/code> i\u00e7inde yer almaktad\u0131r.<\/p>\n<p>Uygulaman\u0131z\u0131n arka ucu, API Gateway&#8217;den gelen iste\u011fi ald\u0131\u011f\u0131nda, <code>Stripe-Signature<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 okur ve i\u00e7indeki imzay\u0131 \u00e7\u0131kar\u0131r. Ard\u0131ndan, iste\u011fin g\u00f6vdesini (ancak bu g\u00f6vde art\u0131k API Gateway taraf\u0131ndan de\u011fi\u015ftirilmi\u015f haldedir) ve payla\u015f\u0131lan gizli anahtar\u0131 kullanarak kendi imzas\u0131n\u0131 hesaplar. Ancak, arka ucunuzun hesaplad\u0131\u011f\u0131 imza, Stripe&#8217;\u0131n orijinal olarak g\u00f6nderdi\u011fi imza ile e\u015fle\u015fmez. \u00c7\u00fcnk\u00fc arka ucunuz, API Gateway taraf\u0131ndan de\u011fi\u015ftirilmi\u015f bir payload \u00fczerinde hesaplama yapm\u0131\u015ft\u0131r, Stripe ise orijinal payload \u00fczerinde hesaplama yapm\u0131\u015ft\u0131r.<\/p>\n<p><strong>Sonu\u00e7lar:<\/strong><\/p>\n<ul>\n<li><strong>Ge\u00e7erli \u0130\u015flemlerin Reddedilmesi:<\/strong> M\u00fc\u015fterileriniz \u00f6deme yapsa bile, &#8220;\u00f6deme ba\u015far\u0131l\u0131&#8221; web kancalar\u0131 ge\u00e7ersiz imza nedeniyle reddedilir. Sipari\u015fler &#8220;beklemede&#8221; veya &#8220;\u00f6deme ba\u015far\u0131s\u0131z&#8221; durumunda kal\u0131r.<\/li>\n<li><strong>M\u00fc\u015fteri Memnuniyetsizli\u011fi:<\/strong> \u00d6demesi al\u0131nan m\u00fc\u015fteriler, sipari\u015flerinin i\u015flenmedi\u011fini g\u00f6r\u00fcnce hayal k\u0131r\u0131kl\u0131\u011f\u0131na u\u011frar ve destek ekibinize ba\u015fvurur.<\/li>\n<li><strong>Operasyonel Y\u00fck:<\/strong> Destek ekibiniz, manuel olarak sipari\u015fleri kontrol etmek, \u00f6demeleri do\u011frulamak ve sipari\u015f durumlar\u0131n\u0131 g\u00fcncellemek zorunda kal\u0131r. Bu, zaman ve kaynak kayb\u0131na yol a\u00e7ar.<\/li>\n<li><strong>G\u00fcven Kayb\u0131:<\/strong> Sisteminizin g\u00fcvenilirli\u011fi sorgulan\u0131r, bu da i\u015f ortaklar\u0131 ve m\u00fc\u015fteriler nezdinde itibar kayb\u0131na neden olabilir.<\/li>\n<li><strong>Hata Ay\u0131klama Zorlu\u011fu:<\/strong> Sorunun kayna\u011f\u0131n\u0131 bulmak zordur, \u00e7\u00fcnk\u00fc her \u015fey &#8220;do\u011fru&#8221; gibi g\u00f6r\u00fcn\u00fcr; imzalar do\u011fru algoritma ile hesaplanm\u0131\u015f, anahtar do\u011fru. Ancak aradaki proxy&#8217;nin JSON&#8217;u de\u011fi\u015ftirmesi g\u00f6zden ka\u00e7abilir.<\/li>\n<\/ul>\n<p><strong>\u00c7\u00f6z\u00fcm: Proxy \u00d6ncesi \u0130mza Do\u011frulama<\/strong><\/p>\n<p>Bu sorunu \u00e7\u00f6zmek i\u00e7in, imza do\u011frulama mant\u0131\u011f\u0131, API Gateway&#8217;in JSON payload&#8217;unu de\u011fi\u015ftirebilecek herhangi bir i\u015flem yapmadan \u00f6nce uygulanmal\u0131d\u0131r. Bunun birka\u00e7 yolu vard\u0131r:<\/p>\n<ol>\n<li><strong>API Gateway \u00dczerinde Do\u011frulama:<\/strong> \u0130deal \u00e7\u00f6z\u00fcm, API Gateway&#8217;in kendisinin webhook imza do\u011frulamas\u0131n\u0131 yapmas\u0131d\u0131r. Bir\u00e7ok modern API Gateway (\u00f6rne\u011fin AWS API Gateway, Kong, Apigee), \u00f6zel kod (lambda fonksiyonlar\u0131 gibi) \u00e7al\u0131\u015ft\u0131rma veya \u00f6nceden tan\u0131mlanm\u0131\u015f politikalar uygulama yetene\u011fine sahiptir. Gateway, ham HTTP iste\u011fini al\u0131r, imzay\u0131 do\u011frular ve ancak ge\u00e7erliyse iste\u011fi arka uca iletir. Bu durumda, arka u\u00e7 hala de\u011fi\u015ftirilmi\u015f bir JSON alabilir, ancak en az\u0131ndan iste\u011fin g\u00fcvenli oldu\u011fu garantilenmi\u015f olur.<\/li>\n<li><strong>Ham Payload&#8217;u De\u011fi\u015ftirmeden \u0130letme:<\/strong> API Gateway&#8217;i, webhook isteklerinin g\u00f6vdesini asla de\u011fi\u015ftirmemesi i\u00e7in yap\u0131land\u0131r\u0131n. Yani, gelen ham JSON&#8217;u oldu\u011fu gibi arka uca iletmelidir. Bu, API Gateway&#8217;in d\u00f6n\u00fc\u015f\u00fcm (transformation) \u00f6zelliklerini bu t\u00fcr istekler i\u00e7in devre d\u0131\u015f\u0131 b\u0131rakmak anlam\u0131na gelebilir.<\/li>\n<li><strong>Uygulama Katman\u0131nda Ham Payload Eri\u015fimi:<\/strong> Uygulaman\u0131z\u0131n arka ucu, gelen HTTP iste\u011finin ham g\u00f6vdesine eri\u015fti\u011finden emin olmal\u0131d\u0131r. Framework&#8217;\u00fcn\u00fcz\u00fcn bu \u00f6zelli\u011fi desteklemesi ve sizin de bunu do\u011fru bir \u015fekilde kullanman\u0131z gerekir. Do\u011frulama, JSON&#8217;u ayr\u0131\u015ft\u0131rmadan (parse etmeden) \u00f6nce yap\u0131lmal\u0131d\u0131r.<\/li>\n<\/ol>\n<p>Bu e-ticaret senaryosunda, API Gateway \u00fczerinde imza do\u011frulamas\u0131n\u0131 uygulayarak, sadece ge\u00e7erli ve g\u00fcvenli webhook&#8217;lar\u0131n arka uca ula\u015fmas\u0131 sa\u011flan\u0131r. Ge\u00e7ersiz veya manip\u00fcle edilmi\u015f istekler daha erken bir a\u015famada engellenir, b\u00f6ylece hem g\u00fcvenlik art\u0131r\u0131l\u0131r hem de operasyonel y\u00fck azal\u0131r. M\u00fc\u015fterilerinizin sipari\u015fleri sorunsuz bir \u015fekilde i\u015flenir ve platformunuzun itibar\u0131 korunur. Bu, &#8220;proxy \u00f6ncesi imza do\u011frulama&#8221; prensibinin ger\u00e7ek d\u00fcnyadaki somut faydalar\u0131n\u0131 g\u00f6stermektedir.<\/p>\n<h2>Sonu\u00e7: Webhook G\u00fcvenli\u011fini Ertelemeyin!<\/h2>\n<p>Web kancalar\u0131, modern, da\u011f\u0131t\u0131k sistem mimarilerinin vazge\u00e7ilmez bir par\u00e7as\u0131d\u0131r ve uygulamalar aras\u0131 ileti\u015fimi kolayla\u015ft\u0131r\u0131r. Ancak, bu kolayl\u0131k beraberinde ciddi g\u00fcvenlik riskleri de getirmektedir. Web kancas\u0131 imzalar\u0131n\u0131 do\u011frulamak, gelen verilerin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve orijinalli\u011fini garanti alt\u0131na alman\u0131n en etkili yoludur. \u00d6zellikle, istekleri y\u00f6nlendiren, d\u00f6n\u00fc\u015ft\u00fcren veya i\u015fleyen proxy sunucular\u0131n\u0131n oldu\u011fu ortamlarda, bu do\u011frulaman\u0131n kritik bir a\u015famada, yani proxy&#8217;nin JSON y\u00fck\u00fcn\u00fc de\u011fi\u015ftirmeden \u00f6nce yap\u0131lmas\u0131 elzemdir.<\/p>\n<p>Proxy&#8217;ler taraf\u0131ndan yap\u0131lan k\u00fc\u00e7\u00fck gibi g\u00f6r\u00fcnen JSON formatlama veya anahtar s\u0131ralamas\u0131 de\u011fi\u015fiklikleri bile, ge\u00e7erli bir web kancas\u0131 imzas\u0131n\u0131n ge\u00e7ersiz say\u0131lmas\u0131na neden olabilir. Bu durum, yanl\u0131\u015f pozitiflere, i\u015f s\u00fcre\u00e7lerinin aksamas\u0131na, m\u00fc\u015fteri memnuniyetsizli\u011fine ve operasyonel maliyetlerin artmas\u0131na yol a\u00e7ar. Bu nedenle, geli\u015ftiricilerin ve sistem mimarlar\u0131n\u0131n, webhook entegrasyonlar\u0131n\u0131 tasarlarken ve uygularken imza do\u011frulama mekanizmalar\u0131n\u0131 en \u00f6ncelikli g\u00fcvenlik \u00f6nlemlerinden biri olarak ele almas\u0131 gerekmektedir.<\/p>\n<p>Gizli anahtar y\u00f6netimi, tekrar oynatma sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma, IP beyaz listeleme ve detayl\u0131 g\u00fcnl\u00fckleme gibi ek g\u00fcvenlik uygulamalar\u0131yla birle\u015fti\u011finde, web kancas\u0131 tabanl\u0131 sistemleriniz \u00e7ok daha diren\u00e7li ve g\u00fcvenilir hale gelir. G\u00fcvenlik, sonradan eklenen bir \u00f6zellik de\u011fil, tasar\u0131m\u0131n ayr\u0131lmaz bir par\u00e7as\u0131 olmal\u0131d\u0131r. Web kancas\u0131 g\u00fcvenli\u011fine yat\u0131r\u0131m yapmak, sadece potansiyel sald\u0131r\u0131lara kar\u015f\u0131 bir kalkan olu\u015fturmakla kalmaz, ayn\u0131 zamanda sistemlerinizin genel sa\u011fl\u0131\u011f\u0131n\u0131 ve i\u015f s\u00fcreklili\u011fini de garanti alt\u0131na al\u0131r. Unutmay\u0131n, bir web kancas\u0131 entegrasyonunda g\u00fcvenlik a\u00e7\u0131\u011f\u0131, t\u00fcm uygulaman\u0131z i\u00e7in bir risk te\u015fkil edebilir. Bu nedenle, web kancas\u0131 g\u00fcvenli\u011fini asla ertelemeyin ve en iyi uygulamalar\u0131 ba\u015ftan itibaren benimseyin.<\/p>\n<h3>S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n<ul>\n<li>\n            <strong>S: Webhook imzas\u0131 nedir ve neden kullanmal\u0131y\u0131m?<\/strong><\/p>\n<p>C: Webhook imzas\u0131, bir web kancas\u0131 iste\u011finin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc (verinin de\u011fi\u015ftirilmedi\u011fi) ve orijinalli\u011fini (ger\u00e7ek kaynaktan geldi\u011fi) do\u011frulamak i\u00e7in kullan\u0131lan kriptografik bir hash de\u011feridir. Payla\u015f\u0131lan bir gizli anahtar ve iste\u011fin ham g\u00f6vdesi kullan\u0131larak olu\u015fturulur. Bunu kullanmak, k\u00f6t\u00fc niyetli akt\u00f6rlerin sahte web kancalar\u0131 g\u00f6ndermesini veya ge\u00e7erli web kancalar\u0131n\u0131 manip\u00fcle etmesini engeller, b\u00f6ylece sisteminizin g\u00fcvenli\u011fini ve veri do\u011frulu\u011funu sa\u011flar.<\/p>\n<\/li>\n<li>\n            <strong>S: Proxy sunucusu, imza do\u011frulama s\u00fcrecini nas\u0131l etkiler?<\/strong><\/p>\n<p>C: Bir proxy sunucusu, gelen web kancas\u0131 iste\u011finin JSON g\u00f6vdesini (payload) yeniden bi\u00e7imlendirme, bo\u015fluklar\u0131 kald\u0131rma, anahtar s\u0131ralamas\u0131n\u0131 de\u011fi\u015ftirme gibi i\u015flemlerle de\u011fi\u015ftirebilir. E\u011fer imza do\u011frulama bu de\u011fi\u015ftirilmi\u015f payload \u00fczerinde yap\u0131l\u0131rsa, al\u0131c\u0131n\u0131n hesaplad\u0131\u011f\u0131 imza, g\u00f6ndericinin orijinal imzas\u0131ndan farkl\u0131 olacak ve me\u015fru istekler bile ge\u00e7ersiz say\u0131lacakt\u0131r. Bu nedenle do\u011frulaman\u0131n, proxy manip\u00fclasyonundan \u00f6nce yap\u0131lmas\u0131 kritik \u00f6neme sahiptir.<\/p>\n<\/li>\n<li>\n            <strong>S: \u0130mza do\u011frulamay\u0131 ne zaman yapmal\u0131y\u0131m?<\/strong><\/p>\n<p>C: \u0130mza do\u011frulamas\u0131n\u0131, gelen HTTP iste\u011finin ham (raw) g\u00f6vdesine eri\u015febildi\u011finiz en erken noktada yapmal\u0131s\u0131n\u0131z. \u0130deal olarak, bu, herhangi bir proxy sunucusunun veya uygulaman\u0131zdaki ara yaz\u0131l\u0131mlar\u0131n (middleware) JSON payload&#8217;unu ayr\u0131\u015ft\u0131rmadan veya de\u011fi\u015ftirmeden \u00f6nce olmal\u0131d\u0131r. Bir API Gateway kullan\u0131yorsan\u0131z, do\u011frulaman\u0131n Gateway katman\u0131nda yap\u0131lmas\u0131 en g\u00fcvenli yakla\u015f\u0131md\u0131r.<\/p>\n<\/li>\n<li>\n            <strong>S: Gizli anahtar\u0131m\u0131 nas\u0131l g\u00fcvenli tutabilirim?<\/strong><\/p>\n<p>C: Gizli anahtarlar\u0131n\u0131z\u0131 asla kod taban\u0131n\u0131zda veya versiyon kontrol sistemlerinde (Git gibi) saklamay\u0131n. Ortam de\u011fi\u015fkenleri, s\u0131r y\u00f6netim servisleri (\u00f6rne\u011fin AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) veya g\u00fcvenli yap\u0131land\u0131rma dosyalar\u0131 gibi y\u00f6ntemleri kullan\u0131n. Ayr\u0131ca, anahtarlar\u0131n\u0131z\u0131 d\u00fczenli olarak de\u011fi\u015ftirmeyi (rotate etmeyi) unutmay\u0131n.<\/p>\n<\/li>\n<li>\n            <strong>S: Tekrar oynatma sald\u0131r\u0131lar\u0131na kar\u015f\u0131 nas\u0131l korunabilirim?<\/strong><\/p>\n<p>C: Tekrar oynatma sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemek i\u00e7in, webhook imzas\u0131n\u0131n yan\u0131 s\u0131ra bir zaman damgas\u0131 (timestamp) da kullan\u0131n. Gelen iste\u011fin zaman damgas\u0131n\u0131n, iste\u011fin al\u0131nd\u0131\u011f\u0131 zamana g\u00f6re belirli bir tolerans i\u00e7inde olup olmad\u0131\u011f\u0131n\u0131 kontrol edin. Ayr\u0131ca, her iste\u011fe benzersiz bir &#8220;nonce&#8221; (kullan\u0131m ba\u015f\u0131na say\u0131) de\u011feri ekleyerek ve bu nonce&#8217;lar\u0131 bir veritaban\u0131nda takip ederek de tekrar eden istekleri engelleyebilirsiniz.<\/p>\n<\/li>\n<\/ul>\n<p>#Teknoloji #WebGeli\u015ftirme #G\u00fcvenlik #Webhook #API<\/p>\n<div class=\"github-example-link\"><strong>\u00d6rnek kod:<\/strong> <a href=\"https:\/\/github.com\/fatihsoysalcom\/webhook-signature-verification-json-manipulation\" target=\"_blank\" rel=\"noopener noreferrer\">github.com\/fatihsoysalcom\/webhook-signature-verification-json-manipulation<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"G\u00fcn\u00fcm\u00fcz\u00fcn birbirine entegre d\u00fcnyas\u0131nda, uygulamalar aras\u0131 veri al\u0131\u015fveri\u015fi web kancalar\u0131 (webhooks) arac\u0131l\u0131\u011f\u0131yla hayati bir rol oynamaktad\u0131r.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-43449","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z\" \/>\n<meta property=\"og:description\" content=\"G\u00fcn\u00fcm\u00fcz\u00fcn birbirine entegre d\u00fcnyas\u0131nda, uygulamalar aras\u0131 veri al\u0131\u015fveri\u015fi web kancalar\u0131 (webhooks) arac\u0131l\u0131\u011f\u0131yla hayati bir rol oynamaktad\u0131r.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-19T06:12:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-19T06:13:29+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"27 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z\",\"datePublished\":\"2026-07-19T06:12:45+00:00\",\"dateModified\":\"2026-07-19T06:13:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/\"},\"wordCount\":5078,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/\",\"name\":\"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-07-19T06:12:45+00:00\",\"dateModified\":\"2026-07-19T06:13:29+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/","og_locale":"tr_TR","og_type":"article","og_title":"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z","og_description":"G\u00fcn\u00fcm\u00fcz\u00fcn birbirine entegre d\u00fcnyas\u0131nda, uygulamalar aras\u0131 veri al\u0131\u015fveri\u015fi web kancalar\u0131 (webhooks) arac\u0131l\u0131\u011f\u0131yla hayati bir rol oynamaktad\u0131r.","og_url":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-07-19T06:12:45+00:00","article_modified_time":"2026-07-19T06:13:29+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"27 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z","datePublished":"2026-07-19T06:12:45+00:00","dateModified":"2026-07-19T06:13:29+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/"},"wordCount":5078,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/","url":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/","name":"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-07-19T06:12:45+00:00","dateModified":"2026-07-19T06:13:29+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/proxy-oncesi-webhook-imzalarini-dogrulama-json-manipulasyonuna-karsi-kalkaniniz\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Proxy \u00d6ncesi Webhook \u0130mzalar\u0131n\u0131 Do\u011frulama: JSON Manip\u00fclasyonuna Kar\u015f\u0131 Kalkan\u0131n\u0131z"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43449","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=43449"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43449\/revisions"}],"predecessor-version":[{"id":43450,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43449\/revisions\/43450"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=43449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=43449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=43449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}