Lack of timestamp header leaves consumers vulnerable to replay attacks

[mdepinet]

Path: /api-reference/webhooks/format---signature

Hello!

I'm reading through your API docs to evaluate whether Lago is a good fit for our system. I'm surprised by the lack of some sort of request timestamp header that's also encoded into your hmac signatures to prevent replay attacks. I suppose we could work around that with the unique key, but that'd require that we durably store those keys. Do you have a recommended way to work around this?

Thanks!

[jdenquin]

Hello @mdepinet , thats a good one, I think adding the timestamp would enforce this behavior!