Intermediate · 30 min · 4 steps
Checking that a payment message is real, fresh and untouched
Siddharth Jain, Security Infrastructure Engineer at PayForge
Siddharth Jain is a security engineer at PayForge, a payment gateway that handles over 2.5 million UPI and card payments every day in India. At 2:20 PM on a Tuesday, a serious ticket arrives from a team of outside security testers.
The question
How do we check that a payment webhook is genuine, unchanged and not a replay, using HMAC-SHA256, a safe comparison and a time limit in Python?
- HMAC-SHA256
- Timing attack defense
- Replay attack prevention
- Cryptographic hashes
The rest of this case study is locked
The data, every step with its code and result, and the final answer open with a pass. A few case studies stay free so you can see how they work.