Rescue webhook replay window defense

securityEXTREMESECURITY DEBUGGING

Rescue webhook replay window defense

Extreme Security Basics arena: HMAC signatures, timestamp tolerance, idempotency, and delivery dedupe

XP reward

595

Coins

Target time

81m

Mission locked

Missing prerequisites: security-easy-webhook-replay-window

Attackers replay old webhook deliveries and the billing system accepts them as fresh events. You are working inside a secure engineering review room, and the arena only clears when the result is safe, deterministic, and explainable.

Learning objective

Learn to apply HMAC signatures, timestamp tolerance, idempotency, and delivery dedupe in a secure engineering review room while explaining the invariant, safety constraints, and hidden edge cases.

Mission order

Headers include timestamp, signature, delivery id, provider id, and raw body hash. Minimize blast radius, make the result auditable, and explain the tradeoff you chose. Submit the solution plus enough reasoning to pass hidden edge cases.

Visible checks

reproduces the reported failure

Expected: minimal failing case

adds a regression test

Expected: test fails before fix

Clear requirements

Demonstrates HMAC signatures, timestamp tolerance, idempotency, and delivery dedupe
Handles the visible sample and hidden edge cases
Keeps output deterministic and explainable
Avoids unsafe dynamic execution

Secure validation contract

Judge type

SECURITY DEBUGGING

Complexity target

Minimal reproduction, source-cause fix, and regression test

Workspace

Code editor

locked

Clear the route first

You can read the mission brief, but the editor, hints, tests, and submit flow stay locked until progression or plan access catches up.

Enter Immersive

Test Results

Run the visible checks when your first pass is ready.

Clear Protocol

1Read the scenario and restate the expected output shape.

2Run visible checks before chasing hidden edge cases.

3Use Genie for one nudge if stuck, then explain the invariant.

4Submit only when the result is deterministic and safe.

Rewards

595

Coins

Mission Route

Previous Next

Back to catalog

Hints

Hints are metered and logged for No Hint Hero runs.

Genie Mentor Core

Hint protocol / contextual guardrails active

Progressive hints

Failed-test aware

Solution guarded

Mission: security-extreme-webhook-replay-window0 attempts0 failed tests0 hints used

Progressive hint depth

Genie: Genie online. I use your mission, attempts, failed tests, hints, and path context to coach the next rep without dumping answers first.

Related Missions

Rescue JWT algorithm confusion audit

EXTREME / 560 XP

Rescue SSRF URL filter repair

EXTREME / 565 XP

Rescue XSS markdown renderer fix

EXTREME / 570 XP

Rescue RBAC admin leak closure

EXTREME / 575 XP

Rescue secret redaction in logs

EXTREME / 580 XP

securityEXTREMESECURITY DEBUGGING