`X-StellarGate-Event` header is not covered by the signature (event-type spoofing)

[Darkdruce]

Summary

The HMAC signature covers "{timestamp}.{body}", but the X-StellarGate-Event header is sent separately and is not part of the signed material.

Location

• src/webhook.rs:33-40 (signs timestamp + body only)
• src/webhook.rs:118 / src/api/payments.rs:427 (send unsigned X-StellarGate-Event)

Details & impact

Receivers that route or make decisions based on the (convenient) header rather than the signed body event field can be misled — the header can be altered on-path without invalidating the signature, and on redelivery it is even hard-coded to payment.completed (see related issue).

Suggested fix

Document that only the body is authenticated (route on the signed event field), or include the event in the signed material.

Acceptance criteria

• Event routing relies only on signed data, and docs say so explicitly.

[Dayz-tech-co]

Hi, I'd like to work on this issue. I've gone through the description and acceptance criteria and I'm confident I can deliver it. I'll make sure every acceptance criterion is met and submit a clean, tested PR. Please assign it to me.

[olaayoade91-byte]

hello i would like to work on this issue please assign me

[grantfox-oss]

🦊 GrantFox — @olaayoade91-byte has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #160)
2. Your PR will be reviewed by the StellarGateLabs maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@olaayoade91-byte's PR #180 was approved and merged by @Manuel1234477.

🏆 @olaayoade91-byte: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (83 total points). Track your full progress on GrantFox.

👏 Great work, @olaayoade91-byte! Keep contributing to StellarGateLabs.