Summary
The verifyWebhookSignature helper uses crypto.timingSafeEqual for constant-time comparison but this property has no unit test coverage. Tests should confirm the helper rejects signatures that differ by a single character and returns false rather than throwing for length-mismatched signatures.
Scope
- Test signature differing in the last character returns false
- Test signature differing in the first character returns false
- Test a signature that is one character shorter than expected returns false without throwing
- Test a signature that is one character longer than expected returns false without throwing
Acceptance Criteria
ETA: 12 hours
Coordinate on Telegram
Summary
The
verifyWebhookSignaturehelper usescrypto.timingSafeEqualfor constant-time comparison but this property has no unit test coverage. Tests should confirm the helper rejects signatures that differ by a single character and returns false rather than throwing for length-mismatched signatures.Scope
Acceptance Criteria
ETA: 12 hours
Coordinate on Telegram