openvibers/openvibe.sdk Commits

0.4.0: replay protection for Events webhook deliveries (signature v2)

OP OpenVibers committed 23 Sept 2026 · tag v0.4.0 · 0 files, +0 −0

- openvibe-sdk/events: verifyDeliveryV2(raw, headers, secret, { toleranceSec = 300, now }) checks
  X-OpenVibe-Signature-V2 (t=<ts>,v2=<HMAC-SHA256 of "<ts>.<raw body>">) in constant time and
  refuses timestamps outside ±toleranceSec or disagreeing with X-OpenVibe-Timestamp
- parseDelivery(raw, headers, secret, { requireV2 = false, toleranceSec, now }): a present v2
  header must verify and be fresh (never a v1 fallback); without one, v1 only while requireV2 is off
- signDeliveryV2() and signDeliveryHeaders() for tests; verifyDelivery/signDelivery (v1) unchanged
- mock Events deliverEvents() sends v1 + v2 headers, signed afresh on every attempt
- types, ESM, README (Receiving event webhooks), CHANGELOG; version 0.4.0 (not tagged)