Add tests for webhook signature verification clock skew and replay window

[thlpkee20-wq]

Description

src/lib/webhookSignature.ts and src/middleware/webhookAuth.ts verify the WEBHOOK_SIGNATURE_HEADER/WEBHOOK_TIMESTAMP_HEADER, but tests should prove the timestamp tolerance rejects stale or future-dated requests and that signature comparison is constant-time. Expand coverage on the clock-skew and replay-protection logic.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: src/lib/webhookSignature.ts, src/middleware/webhookAuth.ts, src/middleware/webhookAuth.test.ts
• Stale timestamps outside the tolerance window must be rejected as unauthorized

Suggested execution

• Fork the repo and create a branch
• git checkout -b test/webhook-clock-skew
• Implement changes
  • Add tests for timestamps just inside/outside the allowed skew
  • Assert tampered signatures are rejected and comparison is constant-time
  • Assert missing headers return 401
• Validate security and correctness assumptions

Test and commit

• Run tests
  • npm test
• Cover edge cases
  • Future-dated timestamp, replayed payload, wrong secret, malformed signature header
• Include test output and notes

Example commit message

test: cover webhook signature clock skew and replay

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours

[daveedAJ]

@daveedAJ has applied to work on this issue as part of the Stellar Wave Program's 5th wave.

Hello team,

I’d like to work on this issue because it strengthens webhook security and reliability by properly testing timestamp tolerance, replay protection, and constant-time signature verification. I’ve worked on writing and improving test coverage for backend authentication flows and edge cases, including security-focused validation logic.

Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @daveedAJ to this issue.

[Douglas4tech]

@Douglas4tech has applied to work on this issue as part of the Stellar Wave Program's 5th wave.

I’d like to work on this. I specialize in full-stack development and secure smart contract architecture. Given the requirements here, I believe my experience with scalable backends and blockchain security would be a great fit.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Douglas4tech to this issue.

[drips-wave]

Congratulations, @Douglas4tech! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 2, 2026.

🧑‍💻 @Douglas4tech: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊