Description
Provide secure webhook delivery by adding support for JWE payload encryption.
Current Problem
Webhook payloads containing transaction details are transmitted in plain text, exposing data to interception on public networks.
Proposed Solution
Add options to encrypt webhook bodies using the recipient's public key following the JWE (RFC 7516) standard.
Technical Tasks
Acceptance Criteria
- Webhooks contain a valid JWE compact serialization payload when encryption is enabled
- Unencrypted deliveries function normally if no public key is configured
- Signature headers are still computed and attached correctly to requests
Testing Requirements
- Encrypt a payload and verify successful decryption using the corresponding private key
Metadata
- Priority: Medium
- Difficulty: High
Description
Provide secure webhook delivery by adding support for JWE payload encryption.
Current Problem
Webhook payloads containing transaction details are transmitted in plain text, exposing data to interception on public networks.
Proposed Solution
Add options to encrypt webhook bodies using the recipient's public key following the JWE (RFC 7516) standard.
Technical Tasks
Acceptance Criteria
Testing Requirements
Metadata