Os Labs / Backend
BackendWorking~8h
Signature-Verified Webhook Receiver
An HTTP endpoint that verifies HMAC-SHA256 signatures on inbound webhooks (Stripe-style), rejects requests with invalid or missing signatures, and enforces a replay window using a stored nonce/timestamp so the same event can't be processed twice. Includes a signed test client to simulate a real sender.
O que isso prova
A frase que você pode defender em uma entrevista.
Linha do currículo
Built a webhook receiver with HMAC signature verification, timestamp-based replay protection, and idempotent event processing, backed by automated tests for forged and replayed payloads.
- route
- decide
- prove
O briefing
O que você constrói, passo a passo.
- 01POST /webhooks/:provider accepts raw request body and a signature header; verification runs against the raw bytes, not a re-serialized JSON object
- 02Signature check uses constant-time comparison (timingSafeEqual) and a per-provider shared secret loaded from environment config
- 03Requests older than a 5-minute timestamp window are rejected with 400, independent of signature validity
- 04Each verified event's unique ID is stored in a processed_events table with a unique constraint; a duplicate ID short-circuits with 200 OK and no side effects
- 05Invalid signature, expired timestamp, and duplicate event each return distinct, documented status codes and error bodies
- 06A CLI or script signs a payload with a known secret so tests can generate valid, invalid, expired, and replayed requests deterministically
A prova
Está pronto quando estes passarem.
Forged signature (wrong secret) is rejected with 401 and no DB row is written
automated test
Tampered payload with a valid-looking signature header is rejected
automated test
Replaying an already-processed event ID returns 200 without duplicating side effects (checked via row count)
automated test
Timestamp outside the replay window is rejected even with a correct signature
automated test
Stack
Node.jsExpressPostgreSQLcrypto (HMAC-SHA256)Vitest
Método Sage
route → decide → prove
Você mantém
Running webhook endpoint + signed test client + test suite proving forged/replayed/expired requests are rejected