Skip to content

Add unit tests for verifyWebhookSignature helper covering timing-safe comparison behaviour #666

Description

@Chucks1093

Summary

The verifyWebhookSignature helper uses crypto.timingSafeEqual for constant-time comparison but this property has no unit test coverage. Tests should confirm the helper rejects signatures that differ by a single character and returns false rather than throwing for length-mismatched signatures.

Scope

  • Test signature differing in the last character returns false
  • Test signature differing in the first character returns false
  • Test a signature that is one character shorter than expected returns false without throwing
  • Test a signature that is one character longer than expected returns false without throwing

Acceptance Criteria

  • Single trailing character difference returns false
  • Single leading character difference returns false
  • Shorter signature returns false without throwing
  • Longer signature returns false without throwing

ETA: 12 hours


Coordinate on Telegram

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave program

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions