use an exact path comparison when a security rule should apply to one webhook endpoint only. A broad substring match can also catch test routes, nested routes, or unrelated URLs with a similar name.
Why it happens
A rule that checks whether a request path contains /webhooks/payment is wider than it first appears. It may also match paths such as:
/webhooks/payment-test/webhooks/payment/archive/old/webhooks/payment
If the intended endpoint is only /webhooks/payment, an exact comparison expresses that intent more clearly.
Choose the operator from the route design
- Use equals when one fixed URL path should match.
-
Use starts with when a whole route family should match, such as every path below
/webhooks/payment/. -
Use contains only when the text may legitimately appear in different positions.
The safest operator is usually the narrowest one that still covers the real traffic.
A practical check
Before enabling the rule, write down one request that must match and several that must not match. For example:
- Should match:
/webhooks/payment -
Should not match:
/webhooks/payment-test -
Should not match:
/webhooks/payment/debug
Then use the platform’s rule preview, request logs, or test mode to confirm those cases. Also check the rule action separately. A correct match condition does not prove that the action is appropriate.
Common mistakes
Cause: A copied rule uses contains because it looks flexible.
Fix: Replace it with an exact comparison when the endpoint is fixed.
Cause: The path condition is reviewed, but the action is not.
Fix: Verify both the match and the resulting action before deployment.
Cause: A route family is treated as one exact path.
Fix: Use an intentional prefix rule and test the boundary around the trailing slash.
Path scope is not webhook authentication
Constrain the hostname and HTTP method when the provider defines them, and test slash and case behavior against the application’s actual route handling. An exact path limits a rule’s scope; the application must still verify the provider signature, timestamp, and replay policy. Avoid interactive browser challenges on server-to-server callbacks.
Small differences in matching operators can change the scope of a security rule. The concrete next action is to test one expected webhook path and at least two similar paths that must stay outside the rule.