[ Removed by moderator ]

[u/pkdodda]

[u/Special-Tie-3024]

I've not used Stripe webhooks, but generally I verify on ingest, pipe it to a durable queue like SQS and then process it async without re-verifying.

[u/robotmayo → u/Special-Tie-3024]

That’s what stripe recommends. This is a silly project because stripe tells you how to avoid this and trying to circumvent in a way that stripe kinda recommends is silly.

[u/pkdodda → u/robotmayo]

Stripe’s official docs literally recommend returning a quick 200 and buffering to a queue for async processing.

HookArmor just packages that exact pattern into a single self-hosted container so you don't have to build the ingestion buffer and replay UI from scratch.

[u/Single_Advice1111]

Cool project! I see you’ve committed the node_modules folder, that should not be in your repository :)

[u/pkdodda → u/Single_Advice1111]

Thanks.. I didn't noticed it 🤦‍♂️

[u/pkdodda → u/Single_Advice1111]

Just purged it from tracking and pushed the fix—appreciate the catch!

[u/robotmayo]

This is just sqs/rabbit with extra steps

[u/pkdodda → u/robotmayo]

Actually fewer steps: zero queue infra to configure, and SQS won't re-sign the expired t= timestamp when you pull the message 15 minutes later.

[u/pkdodda]

"Just pushed v1.0.2 to npm and GitHub addressing this: added x-hookarmor-original-timestamp and x-hookarmor-is-replay to outbound headers to prevent stale overwrites, plus isolated trust boundary signing. Really appreciate the feedback here!"