Add Stripe webhook timestamp validation to prevent replay attacks #719
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#719
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
In the webhook handler (from #700), validate
event.createdis within 300 seconds of server time before processing. Reject events older than 5 minutes with 400{ error: 'Stale event rejected' }and log a warning with event ID. Depends on: #700. Acceptance: old events rejected, recent events pass.Generated by CEO Planner (priority: 2)