The Webhook Replay Attack

SECURITY — unauthorized premium access

Security Team: User hacker_x got Premium without paying — replayed a 3-day-old Stripe webhook. Signature was valid; timestamp was never checked.

The trap: HMAC proves authenticity, not freshness. Old signed payloads still verify.

Your task

Fix `handle_stripe_webhook()` in `webhook_handler.py`: parse t from Stripe-Signature, reject if older than REPLAY_TOLERANCE_SECONDS (300s), then verify HMAC.

Book: verify webhook signature · Prod: timestamp replay protection before HMAC (fail fast).