Webhook / signature / replay boundary

Separate Webhook signatures and replay conditions

Review signature, timestamp, replay and idempotency conditions that are often mixed together at receipt time. Real Webhooks and secrets are never used; save a receive review note locally.

Review decisions Save review note

Five receive boundaries

A matching signature does not prove that a timestamp is fresh, a notification is not a replay, or processing is idempotent. Record each receive check separately.

signature ≠ fresh ≠ idempotent / verify → reject → record

Axis	Review
signature	Verify the signature without handing off the secret itself.
timestamp	Set a time window and reject old notifications.
replay	Detect and reject a repeated event or nonce.
idempotency	Prevent duplicate effects when a delivery is retried.
fail-closed	Do not process a notification that cannot be verified.

Safe review order

Separate signature verification from the timestamp window.
Choose an event identifier for replay detection.
Check the result of a retry under idempotency.
Approve the local note before returning to a real receiver.

This page never sends or receives a real Webhook and never accepts secrets or user payloads. It uses synthetic cases only.

Six synthetic cases

case	result
`signature-valid`	Signature valid
`timestamp-window`	Timestamp window
`replay-detected`	Replay detected
`idempotency-key`	Idempotency key
`signature-mismatch`	Reject mismatch
`local-note`	Local handoff