SecureMidSecurityAuto-graded
Reject forged and replayed webhook requests
Two invisible flaws must be spotted: a secret leaking through response timing, and requests that never expire.Your service receives webhooks from a payment provider, every request is signed, andwebhook.py is supposed to reject anything that is not authentic. A security review has just flagged it: the signature check is broken in three ways and the endpoint is currently accepting both forged and replayed requests. Make it return true only for a genuine, fresh request.30 min
python
You're done when
- A fresh, correctly signed request is accepted.
- A request whose payload has been tampered with is rejected.
- A request signed with the wrong secret is rejected.
- A malformed signature header is rejected without raising.
- A garbage signature value is rejected.
- A stale request outside the freshness window is rejected, defeating replay.
- A timestamp too far in the future is rejected, while one inside the window is accepted.
- The signature comparison is constant-time rather than a naive equality check.
What it measures
Application securityVerifying authenticity and freshness together, since a valid signature on a replayed request is still an attack.
CryptographyComputing and comparing an HMAC correctly, including constant-time comparison.
Hostile input handlingRejecting malformed headers cleanly, so a crash never becomes the bypass.
Your environment
Terminal + editorA full shell in the browser
Claude CodePre-authenticated, no key setup
Isolated microVMYours alone, wiped afterwards
Start this lab
30 min
Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo