Add Stripe webhook timestamp validation to reject stale events #1279

New issue

Open

opened 2026-04-13 11:17:35 -04:00 by pook · 0 comments

pook commented

2026-04-13 11:17:35 -04:00

Owner

Add timestamp validation to the Stripe webhook handler to reject events older than 5 minutes, preventing replay attacks.

Implementation:

In the webhook route handler, after signature verification, extract event.created (Unix timestamp)
Compare with Math.floor(Date.now() / 1000) — reject if difference > 300 seconds with HTTP 400
Log rejected events with event ID and age for monitoring
Add unit test: mock a Stripe event with created timestamp 6 minutes ago, verify 400 response
Add unit test: mock a recent event, verify it passes through

This mirrors the contractpilot #1203 requirement but for compliancebot.

Acceptance criteria: Stale events (>5min) rejected with 400, recent events pass, tests pass, build clean.

Generated by CEO Planner (priority: 3)

Add timestamp validation to the Stripe webhook handler to reject events older than 5 minutes, preventing replay attacks. Implementation: 1. In the webhook route handler, after signature verification, extract event.created (Unix timestamp) 2. Compare with Math.floor(Date.now() / 1000) — reject if difference > 300 seconds with HTTP 400 3. Log rejected events with event ID and age for monitoring 4. Add unit test: mock a Stripe event with created timestamp 6 minutes ago, verify 400 response 5. Add unit test: mock a recent event, verify it passes through This mirrors the contractpilot #1203 requirement but for compliancebot. Acceptance criteria: Stale events (>5min) rejected with 400, recent events pass, tests pass, build clean. --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-13 11:17:35 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#1279

No description provided.

Rows
Columns