Aglet

Investigate webhook signature verification failures

Investigation should show exactly what the verifier received and why it disagreed. Build valid, altered, stale, wrong-secret, and encoding fixtures, then follow bytes through middleware. Keep body mutation, secret selection, freshness, and forged input as separate hypotheses in the receiver stack.

Build a useful investigation brief

  1. Build signed byte fixtures

    Create a known raw body, its signature metadata, a reserialized body, an altered value, a stale timestamp, and a wrong secret. Record expected accept or reject state before execution. Keep secrets synthetic and payloads free of sensitive data.

  2. Trace verifier inputs

    Capture raw length, content type, header parsing, selected secret label, signed timestamp, computed result, and middleware revision. Compare the exact bytes before and after parsing. Note the first changed character or header rather than describing the bodies generally.

  3. Test one trust variable

    Vary body bytes, header, secret, timestamp, encoding, or proxy behavior separately. Compare timing-safe result and freshness result. If the raw body cannot be recovered at the endpoint, state that evidence boundary instead of asserting which layer changed it.

What to carry forward

The investigation is ready when fixtures reproduce the first byte, header, secret, or timestamp divergence and its safe disposition. Recommend a narrow verifier or middleware change. Leave unobserved endpoint and secret behavior explicit. Keep the signed input available for review.

Technical background: Coinbase developer documentation.

Keep the decision with the work.

Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.

Create an account See the product workflow