Incident Dossier

Webhook signature tolerance too wide

Security logs show that a payment.succeeded webhook delivered yesterday still verifies successfully today. An attacker with a brief packet capture can re-submit the same payload and re-trigger the same side effect.

Initial failing signalAn 11-minute-old signature is still acceptedExpected behavior: verify() returns false for an 11-minute-old signature · actual behavior: verify() returns true for an 11-minute-old signature

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Inspect the constant that controls how old a signature can be.
Notice the value is far larger than provider recommendations.
Reduce it to the standard 5-minute tolerance used by real webhook libraries.

Focus Mode

Start

src/signature.js

Likely area

src/signature.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicHTTP/API

DifficultyMedium

Est. time16 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace