How a Raw-Body Bug Silently Breaks Paddle Billing Webhook Verification

·2 views

Paddle Billing webhooks use HMAC-SHA256 signatures delivered via the Paddle-Signature HTTP header, requiring verification against the exact raw request bytes Paddle originally sent. A common developer mistake occurs when web frameworks auto-parse the JSON body, and the code re-serializes it before verification, producing different bytes that cause every legitimate webhook to fail. The signed string Paddle constructs combines the timestamp and raw body in the format ts:raw_body, meaning omitting the timestamp prefix also invalidates the computed digest. Paddle Billing, the default for accounts created after August 2023, uses a per-destination secret for signing and is entirely different from the legacy Paddle Classic scheme, which relied on PHP serialization and a public key. The fix requires capturing and preserving the raw, unparsed request body before any framework processing, then parsing it only after the signature has been successfully verified.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ADHD Writer Explains Why AI Is an Accessibility Tool, Not Just Lazy Shorthand

A developer and writer with ADHD has published a personal account explaining how AI writing tools function as accessibility aids rather than shortcuts. The author argues that ADHD impairs executive function, making tasks like structuring thoughts or starting a blank page disproportionately difficult compared to neurotypical writers. For them, AI helps convert scattered ideas and voice notes into structured, publishable work — a barrier removal rather than a quality compromise. While acknowledging that much AI-generated content fairly earns the label 'slop,' the author challenges the hidden assumption that all users could have written the same piece unaided. The piece calls for greater nuance in how AI-assisted writing is judged, distinguishing between low-effort output and genuine accessibility use cases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds EyeNet to Convert Live Campus Camera Feeds Into Structured Security Alerts

A developer has created EyeNet, a real-time campus surveillance system designed to convert raw webcam video into structured, queryable security incidents rather than simple object-detection outputs. The system uses a multi-stage pipeline combining face recognition, YOLOv8 hazard detection, and ByteTrack object tracking to ensure alerts are only triggered after a detection persists across multiple frames, significantly reducing false positives. A priority-based event bus ensures critical threats such as guns or fire are handled before lower-severity events like uniform violations, while an anomaly scoring system assigns each alert a 0–100 urgency score. Alerts, snapshots, and metrics are stored in a SQLite database, and a Flask dashboard delivers live video, real-time alerts via Server-Sent Events, and a searchable audit trail. The project was built to address common pain points in campus security, including the inability to monitor multiple feeds simultaneously and the lack of a structured, traceable alert history.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kiro AI Tool Automates Hugging Face Text Summarizer Setup with GPU and Batch Support

A developer demonstrated how Kiro, an AI coding assistant, can build a fully functional text summarizer using Hugging Face's transformers library through natural conversation. Kiro autonomously selected the sshleifer/distilbart-cnn-12-6 model, a distilled version of BART trained on CNN/DailyMail data, without being explicitly instructed to do so. The assistant generated Python code handling tokenization, model loading, and summary generation using the correct AutoModelForSeq2SeqLM class for encoder-decoder tasks. The workflow was tested locally on a CPU-only MacBook, with all outputs verified from actual script execution. The exercise highlights how AI coding tools can reduce the complexity of wiring up NLP pipelines, including device management and batching configuration.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Insufficient source content to generate accurate headline

The provided source material contains only a URL and metadata without any substantive article text. No factual summary can be responsibly produced without risking invention of details. Please provide the full article text for accurate reporting.

0 comments Read more at Hacker News