A university uses Meraki webhooks to auto-open dorm Wi-Fi outage tickets. Security requires the Python receiver to prove alerts came from Meraki Dashboard, reject forged posts, and still parse device MAC and alert type. A student replayed an old alert and created a false ticket. Which webhook alert API and shared secret validation behavior should the receiver implement to authenticate Meraki posts?
Select an answer to reveal the explanation.
Short Explanation
Signature checks are your bouncer at the door for dorm alerts. HMAC proves Meraki signed that exact payload with your secret.
Full Explanation
Meraki Dashboard sends webhook POSTs with a shared secret configured per network alert profile and includes an HMAC-SHA256 signature header computed over the raw body, so the receiver must recompute HMAC with the stored secret using constant-time compare and only then parse fields like serial, MAC and alertType, which defeats forgery and detects tampering while still allowing replays to be handled by timestamps or dedupe. Checking source IP fails by concept because cloud sender IPs rotate and spoof easily and provide no integrity proof for the body. Validating an API key in the URL fails by concept because Dashboard webhooks do not carry per-request API keys and query secrets leak in logs without binding to payload content. Decrypting with organization ID fails by concept because the payload is signed plain JSON rather than encrypted with the org ID, so no confidentiality transform proves origin. Exam caveat is to select signature validation over IP allowlists when both appear, and practical check is to log signature match results and test with a known payload and secret in a sandbox receiver.