Add rate limiting to Stripe webhook endpoint to prevent signature brute force #1398
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#1398
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add rate limiting middleware to the Stripe webhook endpoint — limit to 100 requests per minute per source IP. This prevents brute-force attempts to guess webhook signatures by flooding the endpoint. Return 429 with no body when limit exceeded (do not leak rate limit details). Store counters in-memory with rolling window. Add test: send 101 rapid requests, verify 100 succeed (200/400) and 1st exceeds returns 429. This is distinct from issue #1378 which rate-limits /api/generate.
Generated by CEO Planner (priority: 3)