Ahmed Bouhuolia
78fb158b98
POST /api/banking/plaid/webhooks was @PublicRoute() and processed the
body without verifying Plaid's Plaid-Verification JWT, letting any
unauthenticated client replay or fabricate webhook events for a tenant
by guessing a plaidItemId.
Add PlaidWebhookVerificationService that verifies the Plaid-Verification
ES256 JWS using a JWK fetched from plaidClient.webhookVerificationKeyGet
(cached per kid via lru-cache for 24h), enforces a 5-minute iat replay
window through jose.jwtVerify({ maxTokenAge }), and timing-safe compares
the body's SHA-256 against the request_body_sha256 claim. The webhook
controller now consumes the raw body and the plaid-verification header,
runs verification before setupPlaidTenant, and returns 400 Bad Request
on any failure - so no tenant context is ever set for an unsigned or
tampered request.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Simple, smart online accounting software for small and medium businesses.
What's Bigcapital?
Bigcapital is a smart and open-source accounting and inventory software, Bigcapital keeps all business finances in right place and automates accounting processes to give the business powerful and intelligent financial statements and reports to help in making decisions.
Getting Started
We've got serveral options on dev and prod depending on your need to get started quickly with Bigcapital.
Self-hosted
Bigcapital is available open-source under AGPL license. You can host it on your own servers using Docker.
Docker
To get started with self-hosted with Docker and Docker Compose, take a look at the Docker guide.
Development
Local Setup
To get started locally, we have a guide to help you.
Gitpod
- Click the Gitpod button below to open this project in development mode.
- This will open and configure the workspace in your browser with all the necessary dependencies.
Headless Accounting
You can integrate Bigcapital API with your system to organize your transactions in double-entry system to get the best financial reports.
Resources
- Documentation - Learn how to use.
- API Reference - API reference docs
- Contribution - Welcome to any contributions.
- Discord - Ask for help.
- Bug Tracker - Notify us new bugs.
Changelog
Please see Releases for more information what has changed recently.
Contact us
Meet our sales team for any commercial inquiries.
Recognition
Contributors
Thanks goes to these wonderful people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!