One platform to write, cross-post to Dev.to, Medium, WordPress, Hashnode, and Bluesky, and protect your SEO with canonical links. Zero paywalls and full content ownership.
The detail that stands out is verifying the signature against the raw bytes before any JSON parsing, since re-serialising a body that verified fine is exactly the kind of silent breakage that is hard to trace in production. The pairing of a short timestamp window with event-ID deduplication is also a neat division of labour: the window limits how long a captured request stays useful, while dedup makes a replay inside that window harmless. One question: with the five-minute window checked before the HMAC, how does the receiver handle a sender whose clock runs a little ahead — is the tolerance for future timestamps the same five minutes, or tighter?
In this implementation, the tolerance is the same five minutes in both directions. So a sender running slightly ahead is allowed, but anything beyond that is rejected. Keeping the server clock synced with NTP helps avoid these issues.
OneLifeVibe
The detail that stands out is verifying the signature against the raw bytes before any JSON parsing, since re-serialising a body that verified fine is exactly the kind of silent breakage that is hard to trace in production. The pairing of a short timestamp window with event-ID deduplication is also a neat division of labour: the window limits how long a captured request stays useful, while dedup makes a replay inside that window harmless. One question: with the five-minute window checked before the HMAC, how does the receiver handle a sender whose clock runs a little ahead — is the tolerance for future timestamps the same five minutes, or tighter?