security: add X-StellarStream-Signature HMAC-SHA256 header to webhooks#187
Conversation
Wave 4 – Security hardening
## What changed
- webhook.ts: export computeSignature(secret, body) helper that computes
sha256=<hex> via HMAC-SHA256 (crypto.createHmac)
- webhookWorker.ts: replace inline createHmac call with computeSignature;
rename header X-Webhook-Signature → X-StellarStream-Signature
- webhook.test.ts: add two unit tests for computeSignature
• cross-validates against a manual createHmac call
• asserts a known fixed digest (hello / secret)
- README.md: update webhook signing section – correct header name,
add full Node.js verification example using timingSafeEqual
## Why
Webhook consumers had no way to verify that a delivery originated from
StellarStream. The HMAC-SHA256 signature lets receivers authenticate
payloads before processing them, preventing spoofed or replayed events.
## Verification
All 6 webhook tests pass (npm test -- run src/services/webhook.test.ts).
|
@Dafuriousis is attempting to deploy a commit to the ritik4ever's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@Dafuriousis Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
closes #157
Wave 4 – Security hardening
What changed
Why
Webhook consumers had no way to verify that a delivery originated from StellarStream. The HMAC-SHA256 signature lets receivers authenticate payloads before processing them, preventing spoofed or replayed events.
Verification
All 6 webhook tests pass (npm test -- run src/services/webhook.test.ts).