flippercloud/flipper · error · Flipper::Cloud::MessageVerifier::InvalidSignature

Timestamp outside the tolerance zone (#{Time.at(timestamp)})

Error message

Timestamp outside the tolerance zone (#{Time.at(timestamp)})

What it means

Error "Timestamp outside the tolerance zone (#{Time.at(timestamp)})" thrown in flippercloud/flipper.

Source

Thrown at lib/flipper/cloud/message_verifier.rb:64

      # Returns true otherwise.
      def verify(payload, header, tolerance: nil)
        begin
          timestamp, signatures = get_timestamp_and_signatures(header)
        rescue StandardError
          raise InvalidSignature, "Unable to extract timestamp and signatures from header"
        end

        if signatures.empty?
          raise InvalidSignature, "No signatures found with expected version #{@version}"
        end

        expected_sig = generate(payload, timestamp)
        unless signatures.any? { |s| secure_compare(expected_sig, s) }
          raise InvalidSignature, "No signatures found matching the expected signature for payload"
        end

        if tolerance && timestamp < Time.now - tolerance
          raise InvalidSignature, "Timestamp outside the tolerance zone (#{Time.at(timestamp)})"
        end

        true
      end

      private

      # Extracts the timestamp and the signature(s) with the desired version
      # from the header
      def get_timestamp_and_signatures(header)
        list_items = header.split(/,\s*/).map { |i| i.split("=", 2) }
        timestamp = Integer(list_items.select { |i| i[0] == "t" }[0][1])
        signatures = list_items.select { |i| i[0] == @version }.map { |i| i[1] }
        [Time.at(timestamp), signatures]
      end

      # Private
      def fixed_length_secure_compare(a, b)

View on GitHub (pinned to 1f86de3ec9)

Solutions

1. Sync the server clock with NTP; clock skew is the usual cause of timestamp tolerance failures
2. If the webhook was replayed from old logs, ignore or re-send a fresh event instead
3. Increase the tolerance only if you understand the replay-protection trade-off

When it happens

Trigger: Thrown at lib/flipper/cloud/message_verifier.rb:64 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flippercloud/flipper@1f86de3ec9 (2026-08-23). Data as JSON: /api/errors/d5cc65cf7e389e12. Report an issue: GitHub.