Webhook security #1766 - #1783
Merged
Merged
Conversation
…eService - Add DEFAULT_TIMESTAMP_FRESHNESS_SECONDS constant - Add getTimestampFreshnessMs() method to retrieve configured timestamp window - Add isTimestampFresh() method to validate timestamps are within freshness window - Supports clock skew tolerance in both directions - Returns false for missing, malformed, or stale timestamps
…eplay detection status code - Add ConflictException import for proper 409 status code on replayed events - Validate X-Webhook-Timestamp header freshness before checking for replays - Return 401 (UnauthorizedException) for invalid/stale timestamps - Return 409 (ConflictException) instead of 401 for replayed events per RFC 6585 - Improves security by preventing timestamp-based replay attacks - Maintains proper HTTP status semantics
…ation - Add tests for getTimestampFreshnessMs() method and default behavior - Add tests for isTimestampFresh() covering: - Recent timestamps within freshness window - Old timestamps outside the freshness window - Missing, empty, and malformed timestamps - Clock skew tolerance in both past and future directions - Ensures timestamp validation prevents replay attacks with stale payloads
…ict exceptions - Update mock to include isTimestampFresh method - Add X-Webhook-Timestamp header to test requests - Test timestamp validation occurs before replay detection - Test invalid/stale timestamps throw UnauthorizedException (401) - Test replayed events throw ConflictException (409) instead of UnauthorizedException - Maintains comprehensive coverage of guard behavior with new security features
…ion and conflict status - Update OpenAPI description to include X-Webhook-Timestamp validation - Document 401 status for missing/invalid/stale signatures and timestamps - Document 409 Conflict status for replayed events per RFC 6585 - Clarifies API contract for webhook clients about security validations
- Add ConflictException import to reflect new replay detection behavior - Maintains controller test coverage with new security features
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Webhook Security: HMAC Signature Verification & Replay Protection
Summary
Implements comprehensive webhook security with HMAC-SHA256 signature verification, timestamp freshness validation, and replay protection to prevent injection of forged or replayed oracle/market events.
Changes
isTimestampFresh()to validateX-Webhook-Timestampheaders are within a configurable window (default 300s)WebhookSignatureGuardto validate timestamps before checking replaysTests
Acceptance Criteria Met
✅ Valid fresh payloads pass
✅ Tampered payloads rejected with 401
✅ Stale payloads rejected with 401
✅ Replayed payloads rejected with 409
✅ Constant-time signature comparison used
✅ Unit tests cover all scenarios
Closes #1766