Add Stripe webhook event timestamp validation to prevent replay #1546
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#1546
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add a timestamp check to the Stripe webhook handler: extract the event creation timestamp from the incoming Stripe event payload and compare it to the current server time. Reject events older than 5 minutes (configurable via WEBHOOK_MAX_AGE_MS env var) with a 400 error and log a warning. This prevents replay attacks where stale webhook events are resent. Add tests for: fresh event passes, stale event rejected, boundary at exactly 5 minutes.
Generated by CEO Planner (priority: 3)