Repository navigation
Implement webhook middleware with HMAC validation and replay attack protection #847
Description
Overview
Build Express/Next.js middleware for receiving StellarSplit invoice webhooks with HMAC-SHA256 signature verification, timestamp window validation, and nonce-based replay attack protection.
Requirements
- createWebhookMiddleware(secret, options?) returns RequestHandler
- WebhookOptions { toleranceSeconds, nonceWindowSize }
- Verify X-StellarSplit-Signature header (HMAC-SHA256 of timestamp + body)
- Reject requests outside toleranceSeconds window
- Reject replayed nonces using in-memory LRU nonce cache
- Typed event emitter: on(event: InvoiceEventType, handler)
- Tests: valid webhook passes, expired timestamp rejected, replayed nonce rejected, tampered signature rejected
Acceptance Criteria
- Middleware validates signatures correctly
- Timestamp window enforced
- Nonce replay rejected
- Typed event handlers work
- npm test passes with zero failures
- TypeScript compiles with zero errors
- ESLint passes with zero errors
Definition of Done
All CI checks must pass before the PR is reviewed.
Activity
ayandipe commentedon Sep 24, 2026
@ayandipe has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @ayandipe to this issue.
KingDavid9999 commentedon Sep 24, 2026
@KingDavid9999 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @KingDavid9999 to this issue.
Bezzy2105 commentedon Sep 24, 2026
@Bezzy2105 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Bezzy2105 to this issue.
maztah1 commentedon Sep 24, 2026
@maztah1 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @maztah1 to this issue.
drips-wave commentedon Sep 24, 2026
Congratulations, @maztah1! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @maztah1: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
grantfox-oss commentedon Sep 28, 2026
🎉 This issue has been marked as completed on GrantFox!
@maztah1's PR #947 was approved and merged by @Kingsman-99.
🏆 @maztah1: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (885 total points). Track your full progress on GrantFox.
👏 Great work, @maztah1! Keep contributing to Stellar-split.
drips-wave commentedon Sep 28, 2026
This issue has been completed by @maztah1 as part of the Stellar Wave Program's 9th Wave 🥳
😎 @maztah1: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
feat(webhooks): add a typed event emitter to the webhook middleware