{"action":"closed","issue":{"url":"https://api.github.com/repos/stripe/stripe-dotnet/issues/1183","repository_url":"https://api.github.com/repos/stripe/stripe-dotnet","labels_url":"https://api.github.com/repos/stripe/stripe-dotnet/issues/1183/labels{/name}","comments_url":"https://api.github.com/repos/stripe/stripe-dotnet/issues/1183/comments","events_url":"https://api.github.com/repos/stripe/stripe-dotnet/issues/1183/events","html_url":"https://github.com/stripe/stripe-dotnet/issues/1183","id":322632599,"node_id":"MDU6SXNzdWUzMjI2MzI1OTk=","number":1183,"title":"Signature time validation does not handle server time skew in the past","user":{"login":"samuelkdavis","id":6887841,"node_id":"MDQ6VXNlcjY4ODc4NDE=","avatar_url":"https://avatars0.githubusercontent.com/u/6887841?v=4","gravatar_id":"","url":"https://api.github.com/users/samuelkdavis","html_url":"https://github.com/samuelkdavis","followers_url":"https://api.github.com/users/samuelkdavis/followers","following_url":"https://api.github.com/users/samuelkdavis/following{/other_user}","gists_url":"https://api.github.com/users/samuelkdavis/gists{/gist_id}","starred_url":"https://api.github.com/users/samuelkdavis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/samuelkdavis/subscriptions","organizations_url":"https://api.github.com/users/samuelkdavis/orgs","repos_url":"https://api.github.com/users/samuelkdavis/repos","events_url":"https://api.github.com/users/samuelkdavis/events{/privacy}","received_events_url":"https://api.github.com/users/samuelkdavis/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-05-13T22:28:14Z","updated_at":"2018-07-11T12:43:51Z","closed_at":"2018-07-11T12:43:51Z","author_association":"NONE","body":"The Stripe signature docs state \"Our libraries have a default tolerance of five minutes between the timestamp and the current time\" - [source](https://stripe.com/docs/webhooks/signatures#replay-attacks\r\n)\r\n\r\nHowever the logic around this is ([source](https://github.com/stripe/stripe-dotnet/blob/master/src/Stripe.net/Services/Events/StripeEventUtility.cs#L50)):\r\n\r\n`if (serverTime - webhookTimestamp > tolerance)`\r\n\r\nIf the servers time drifts into the future, this will correctly throw an error. If the server time lags into the past however, the time validation becomes significantly less useful.\r\n\r\nTo fit the definition, absolute value looks like it'd solve this\r\n\r\n`if (Math.Absolute(serverTime - webhookTimestamp) > tolerance)`\r\n\r\nStripe version: current master, 16.1.0\r\n"}}
{"actor":{"display_login":"ob-stripe"}}