The Webhook That Trusted Silence

Payments partner starts requiring HMAC headers. Most traffic is fine. A forged POST without X-Signature still returns 200 because the verifier treats a missing header as 'skip verification' instead of reject.

Initial failing signalmissing signature acceptedExpected behavior: A webhook without a signature is rejected. · actual behavior: A webhook without a signature is accepted.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

POST a body with a valid secret but omit X-Signature.
Verification should fail closed.
A correct signature should still pass.

Focus Mode

Start

src/verify.py
src/handler.py

Likely area

src/verify.py
src/handler.py
src/hmac_util.py

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecurity

DifficultyMedium

Est. time15 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace