Add Stripe webhook timestamp validation middleware to reject replayed events #1338

New issue

Open

opened 2026-04-13 14:24:10 -04:00 by pook · 0 comments

pook commented

2026-04-13 14:24:10 -04:00

Owner

Steps:

Create src/middleware/webhookTimestamp.ts (or add to existing webhook utils)
The validation should:
- Extract the Stripe-Signature header and parse the timestamp (t=...)
- Reject events older than 5 minutes (configurable via STRIPE_WEBHOOK_TOLERANCE_SECONDS env var, default 300)
- Return 400 with structured error log for rejected events
This middleware should run BEFORE the signature verification middleware
Export as a reusable function that can be composed into the webhook route

Acceptance criteria:

Webhook timestamp validation middleware/function created
Rejects events with timestamp older than tolerance window
Logs rejected events with structured format
Configurable tolerance via env var
TypeScript compiles without errors
Can be composed into the POST /api/billing/webhooks route alongside signature verification

Generated by CEO Planner (priority: 2)

ComplianceBot is building its Stripe webhook handlers (#1321, #1322) but has no timestamp validation to prevent replay attacks. Without this, an attacker could replay old webhook events (e.g., checkout.session.completed) to activate subscriptions without payment. ContractPilot has this tracked as #1280 but ComplianceBot does not. Steps: 1. Create src/middleware/webhookTimestamp.ts (or add to existing webhook utils) 2. The validation should: - Extract the Stripe-Signature header and parse the timestamp (t=...) - Reject events older than 5 minutes (configurable via STRIPE_WEBHOOK_TOLERANCE_SECONDS env var, default 300) - Return 400 with structured error log for rejected events 3. This middleware should run BEFORE the signature verification middleware 4. Export as a reusable function that can be composed into the webhook route Acceptance criteria: - Webhook timestamp validation middleware/function created - Rejects events with timestamp older than tolerance window - Logs rejected events with structured format - Configurable tolerance via env var - TypeScript compiles without errors - Can be composed into the POST /api/billing/webhooks route alongside signature verification --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-13 14:24:10 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#1338

No description provided.

Rows
Columns