Request replay safety for webhooks
Replay attacks reuse a previous valid request. Timestamp + signature schemes limit how old a request can be. Reject stale timestamps and verify signatures over the raw body.
Common causes
- No timestamp in signed payload.
- Replay window too large.
- Clock skew between signer and verifier.
How to fix
- Use Timestamp Validator to compare against tolerance.
- Reject requests outside the window.
- Use constant-time signature compare.
Use our tool
Validate timestampRelated