[Python] Make the webhook tolerance configurable. #2055
Conversation
ogenodisho
changed the title
|
|
||
| def __init__(self, whsecret: t.Union[str, bytes]): | ||
| def __init__(self, whsecret: t.Union[str, bytes], whtolerance: timedelta = timedelta(minutes=5)): |
There was a problem hiding this comment.
I think a better approach would be adding the VerifyIgnoringTimestamp method, like we have in Go, as it was discussed in #93
There was a problem hiding this comment.
My concern with this is that it might make it 'easy' to use potentially insecure tolerances. With a separate method it's clear that the security implications are different.
There was a problem hiding this comment.
Hi @svix-lucho, thanks for the review.
I did see that part in the related issue about verifying the webhook while ignoring the timestamp. However, my reasoning for doing it this way is that I think it's actually safer (and more flexible) than allowing consumers to disable the timestamp verification entirely.
If a consumer disables it entirely, they're much more susceptible to replay attacks. However, if the tolerance is configurable, they have the flexibility of tuning the tolerance to suit their use cases, while still being protected against potential replay attacks to a certain degree.
In regards to your second message, I wouldn't be opposed to introducing a verify_using_custom_tolerance method instead.
Please let me know your thoughts.
Motivation
This is to address #93
The motivation is described in detail in the issue.
Solution
Introduce a
timedeltaparameter in the Webhook init function which specifies the tolerance.Consumers may leave this blank and it will default to 5 minutes, or provide
timedelta.maxto essentially bypass tolerance checking.This change is backwards compatible.