Les Labs / Backend
BackendWorking~8h
Signature-Verified Webhook Receiver
An HTTP endpoint that verifies HMAC-SHA256 signatures on inbound webhooks (Stripe-style), rejects requests with invalid or missing signatures, and enforces a replay window using a stored nonce/timestamp so the same event can't be processed twice. Includes a signed test client to simulate a real sender.
Ce que ça prouve
La phrase que vous pouvez défendre en entretien.
Ligne de CV
Built a webhook receiver with HMAC signature verification, timestamp-based replay protection, and idempotent event processing, backed by automated tests for forged and replayed payloads.
- route
- decide
- prove
Le brief
Ce que vous construisez, étape par étape.
- 01POST /webhooks/:provider accepts raw request body and a signature header; verification runs against the raw bytes, not a re-serialized JSON object
- 02Signature check uses constant-time comparison (timingSafeEqual) and a per-provider shared secret loaded from environment config
- 03Requests older than a 5-minute timestamp window are rejected with 400, independent of signature validity
- 04Each verified event's unique ID is stored in a processed_events table with a unique constraint; a duplicate ID short-circuits with 200 OK and no side effects
- 05Invalid signature, expired timestamp, and duplicate event each return distinct, documented status codes and error bodies
- 06A CLI or script signs a payload with a known secret so tests can generate valid, invalid, expired, and replayed requests deterministically
La preuve
C’est terminé quand ces critères sont validés.
Forged signature (wrong secret) is rejected with 401 and no DB row is written
automated test
Tampered payload with a valid-looking signature header is rejected
automated test
Replaying an already-processed event ID returns 200 without duplicating side effects (checked via row count)
automated test
Timestamp outside the replay window is rejected even with a correct signature
automated test
Stack
Node.jsExpressPostgreSQLcrypto (HMAC-SHA256)Vitest
Sage Method
route → decide → prove
Vous conservez
Running webhook endpoint + signed test client + test suite proving forged/replayed/expired requests are rejected