{"record":{"id":"d5cc65cf7e389e12","repo":"flippercloud/flipper","slug":"timestamp-outside-the-tolerance-zone-time-at-ti","errorCode":null,"errorMessage":"Timestamp outside the tolerance zone (#{Time.at(timestamp)})","messagePattern":"Timestamp outside the tolerance zone \\(#(.+?)\\)","errorType":"exception","errorClass":"Flipper::Cloud::MessageVerifier::InvalidSignature","httpStatus":null,"severity":"error","filePath":"lib/flipper/cloud/message_verifier.rb","lineNumber":64,"sourceCode":"      # Returns true otherwise.\n      def verify(payload, header, tolerance: nil)\n        begin\n          timestamp, signatures = get_timestamp_and_signatures(header)\n        rescue StandardError\n          raise InvalidSignature, \"Unable to extract timestamp and signatures from header\"\n        end\n\n        if signatures.empty?\n          raise InvalidSignature, \"No signatures found with expected version #{@version}\"\n        end\n\n        expected_sig = generate(payload, timestamp)\n        unless signatures.any? { |s| secure_compare(expected_sig, s) }\n          raise InvalidSignature, \"No signatures found matching the expected signature for payload\"\n        end\n\n        if tolerance && timestamp < Time.now - tolerance\n          raise InvalidSignature, \"Timestamp outside the tolerance zone (#{Time.at(timestamp)})\"\n        end\n\n        true\n      end\n\n      private\n\n      # Extracts the timestamp and the signature(s) with the desired version\n      # from the header\n      def get_timestamp_and_signatures(header)\n        list_items = header.split(/,\\s*/).map { |i| i.split(\"=\", 2) }\n        timestamp = Integer(list_items.select { |i| i[0] == \"t\" }[0][1])\n        signatures = list_items.select { |i| i[0] == @version }.map { |i| i[1] }\n        [Time.at(timestamp), signatures]\n      end\n\n      # Private\n      def fixed_length_secure_compare(a, b)","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/flippercloud/flipper/blob/1f86de3ec91521585b156445e156642938b19cb0/lib/flipper/cloud/message_verifier.rb#L46-L82","documentation":"Error \"Timestamp outside the tolerance zone (#{Time.at(timestamp)})\" thrown in flippercloud/flipper.","triggerScenarios":"Thrown at lib/flipper/cloud/message_verifier.rb:64 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sync the server clock with NTP; clock skew is the usual cause of timestamp tolerance failures","If the webhook was replayed from old logs, ignore or re-send a fresh event instead","Increase the tolerance only if you understand the replay-protection trade-off"],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1f86de3ec91521585b156445e156642938b19cb0","analyzedAt":"2026-08-23T04:36:09.896Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}