#安全

Rovela signs every webhook delivery with HMAC-SHA256 in the x-resend-signature header (t=…,v1=…). This article walks through verification step by step, with special attention to three common mistakes: raw body handling, replay protection, and constant-time comparison.

Cryptographically secure token generation, hash storage, expiry, rate limiting, and single-use enforcement.

The common security gaps in email OTP implementations — code strength, expiry, rate limiting, constant-time comparison, user enumeration, and logging — and how to address each one.