Add timestamp to webhook signature to prevent replay

[misrasamuelisiguzor-oss]

Description

X-COMEBACKHERE-Signature signs only the body, so a captured request can be replayed indefinitely.

The README and docs/webhooks.md show that the signature header is an HMAC-SHA256 of the raw body only. That proves the payload came from COMEBACKHERE, but it does not prove it is recent. Anyone who captures one signed request, from a log, a proxy, or a misconfigured receiver, can replay it later and it will still verify, which could trigger a duplicate fulfillment.

The common fix, used by Stripe and others, is to sign a timestamp together with the body and send the timestamp in its own header. Receivers then verify the signature and reject messages older than a tolerance such as five minutes. This issue changes the signing input to timestamp.body, adds an X-COMEBACKHERE-Timestamp header, and updates every documented verification snippet.

This is a breaking change for existing receivers. Propose a migration plan in the PR, for example sending both signature formats for one release.

Requirements and context

• Add X-COMEBACKHERE-Timestamp header
• Sign timestamp.body
• Document a recommended 5 minute tolerance

Suggested execution

1. Fork the repo and create a branch

   git checkout -b fix/webhook-timestamp-signature

2. Implement changes

   • Update comebackhere-backend/src/services/webhooks.ts
   • Update the README and docs/webhooks.md verification snippet

3. Test and commit

   • Update webhooks.test.ts
   • Verify the documented snippet against a real payload

Example commit message

fix(webhooks): include timestamp in signature

[Ayomide3271]

@Ayomide3271 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hello Maintainer, I’ve taken the time to carefully examine the issue, understand the requirements, and consider the expected outcome. After reviewing everything, I’m confident that I have the relevant knowledge and experience to work on this task effectively. I’m ready to take ownership of the issue, investigate it thoroughly, and work toward a proper and maintainable solution. Kindly assign the issue to me so I can begin. Thank you for your consideration. I look forward to contributing to the project.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ayomide3271 to this issue.

[isavaima8-alt]

@isavaima8-alt has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

hello please can i work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @isavaima8-alt to this issue.

[drips-wave]

Congratulations, @isavaima8-alt! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.

🧑‍💻 @isavaima8-alt: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊