HMAC Signatures Verify Origin But Not Timing, Leaving APIs Open to Replay Attacks

·1 views

HMAC-based API authentication confirms that a request originated from a known secret holder and was not tampered with in transit, but it does not verify when the request was made or whether it has been processed before. Because HMAC-SHA256 is deterministic, a captured signed request remains valid indefinitely if no timestamp or nonce is included in the signed payload. Real-world cases illustrate the risk: RBKmoney accepted replayed Apple Pay cryptograms for repeated charges, while Shopify's checkout webhook lacked HMAC verification entirely, allowing unsigned payment events to be resent freely. MITRE classifies this pattern as CWE-294 (Authentication Bypass by Capture-replay), and the flaw has recurred across multiple generations of API libraries, including a 2013 OAuth vulnerability and a March 2026 Mattermost Zoom plugin bug. Developers can close the gap by including a timestamp or nonce inside the signed payload and rejecting requests that fall outside a narrow validity window, a practice formalized by Stripe's widely referenced webhook security model.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Smart RAG Systems Must Learn When to Skip Retrieval Entirely

A growing challenge in production RAG (Retrieval-Augmented Generation) systems is not poor retrieval quality but the failure to decide when retrieval should not happen at all. Engineers at DEV Community highlight that blindly retrieving documents for every query adds latency, cost, and context noise while often producing confidently wrong answers. For example, a query about a live order status should route to an API tool, not a static policy document. Experts recommend building a routing layer that can choose between direct answers, tool calls, RAG retrieval, clarification requests, or refusals based on question type. Teams are also urged to treat retrieval similarity scores as evidence thresholds rather than truth signals, and to evaluate whether retrieval was even necessary — not just whether the final answer appeared correct.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Agent Toolkit Brings Curated Cloud Knowledge and API Access to Coding Agents

AWS has released an Agent Toolkit that equips AI coding agents like Claude Code with curated AWS service knowledge and the ability to call AWS APIs directly. The toolkit consists of two independent components: locally stored Agent Skills, which guide service selection and troubleshooting, and an AWS-managed MCP Server that enables live API calls and documentation searches. Setup requires a single command, but users must have AWS CLI 2.35 or later, the uv package manager, and Node.js v22 or above installed beforehand. A notable configuration requirement is specifying the us-east-1 region, as the toolkit is only served from that region and the setup wizard will fail silently without it. The skills are open source under the Apache-2.0 license and are designed to enforce verification of current data rather than relying on the agent's potentially outdated internal knowledge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RAG, Memory, or Tools: A Framework for What AI Agents Should Actually Store

A technical guide published on DEV Community breaks down a common architectural challenge in building production AI agents: deciding where different types of information should live. The piece argues that the core mistake is not choosing between RAG, memory, or tools, but blurring their distinct roles together. According to the framework, tools should handle live system state, RAG should serve large read-only knowledge bases, and memory should store durable, scoped user facts across sessions. The context window is recommended only for temporary working state, while raw conversation logs should not be treated as memory without a clear retrieval and privacy plan. The overall guidance stresses that agents should store less than teams typically assume, but whatever is stored must be deliberate, scoped, and set to expire when no longer accurate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI-Generated n8n Workflows Need Structured Review Pipelines, Not Just Human Eyes

AI tools can now generate n8n automation workflows quickly, but their speed and ease of creation introduce serious operational risks that manual review alone cannot catch. A workflow produced by an AI may run successfully while silently performing unintended actions, such as exposing sensitive data, using over-privileged credentials, or triggering costly API loops. Experts argue that AI-generated workflows should be treated as untrusted executable code rather than harmless suggestions, since they can directly interact with production systems, databases, and third-party services. A reliable review process should combine automated linting, policy checks, execution manifests, and runtime gates alongside human approval, rather than depending on a single reviewer. The core argument is that the reviewer should be a structured pipeline — not an individual — to handle the volume and complexity that AI-assisted workflow generation introduces.

0 comments Read more at DEV Community