flippercloud/flipper · error · Flipper::Cloud::MessageVerifier::InvalidSignature

Unable to extract timestamp and signatures from header

Error message

Unable to extract timestamp and signatures from header

What it means

Error "Unable to extract timestamp and signatures from header" thrown in flippercloud/flipper.

Source

Thrown at lib/flipper/cloud/message_verifier.rb:51

      def header(signature, timestamp)
        self.class.header(signature, timestamp, @version)
      end

      # Public: Verifies the signature header for a given payload.
      #
      # Raises a InvalidSignature in the following cases:
      # - the header does not match the expected format
      # - no signatures found with the expected scheme
      # - no signatures matching the expected signature
      # - a tolerance is provided and the timestamp is not within the
      #   tolerance
      #
      # Returns true otherwise.
      def verify(payload, header, tolerance: nil)
        begin
          timestamp, signatures = get_timestamp_and_signatures(header)
        rescue StandardError
          raise InvalidSignature, "Unable to extract timestamp and signatures from header"
        end

        if signatures.empty?
          raise InvalidSignature, "No signatures found with expected version #{@version}"
        end

        expected_sig = generate(payload, timestamp)
        unless signatures.any? { |s| secure_compare(expected_sig, s) }
          raise InvalidSignature, "No signatures found matching the expected signature for payload"
        end

        if tolerance && timestamp < Time.now - tolerance
          raise InvalidSignature, "Timestamp outside the tolerance zone (#{Time.at(timestamp)})"
        end

        true
      end

View on GitHub (pinned to 1f86de3ec9)

Solutions

1. Ensure the signature header follows the 't=<timestamp>,v1=<sig>' scheme format; malformed headers raise this
2. Check that a proxy or middleware is not stripping or rewriting the signature header
3. Verify you are reading the correct header name for Flipper Cloud webhooks

When it happens

Trigger: Thrown at lib/flipper/cloud/message_verifier.rb:51 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flippercloud/flipper@1f86de3ec9 (2026-08-23). Data as JSON: /api/errors/9191b3213d8a7d27. Report an issue: GitHub.