fix(pwa): require decimal signature timestamps - #66

Merged

ralyodio merged 1 commit into

moshcoder:mainfrom

aiirvizionz:clientkit/strict-signature-timestamp

Jul 30, 2026

aiirvizionz commented Jul 28, 2026

Contributor

Summary

reject non-decimal timestamp strings in signed webhook headers
verify the HMAC against the exact timestamp text from the header
add focused coverage for valid, scientific-notation, and fractional timestamps

Test

node --test apps/pwa/test/signature.test.mjs
node --test apps/pwa/test/credits-webhook.test.mjs (skipped: apps/pwa deps not installed)


          fix(pwa): require decimal signature timestamps

0bb2b5e

ralyodio merged commit be753cf into moshcoder:main

3 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet