Skip to main content

​
HMAC-SHA256 Protocol 🔐

Every HTTP request between the WooPilot Cloud Core orchestrator and the merchant’s WordPress plugin is cryptographically signed using a unique, 256-bit symmetric secret key generated during the initial QR handshake.

​
🧮 Cryptographic Formula

Signature=hash_hmac(’sha256’,X-HUB-Timestamp+RAW_JSON_PAYLOAD,hmac_secret)\text{Signature} = \text{hash\_hmac}\left(\text{'sha256'}, \text{X-HUB-Timestamp} + \text{RAW\_JSON\_PAYLOAD}, \text{hmac\_secret}\right)

​
🛡️ Key Security Properties

  1. Replay Attack Defense: The plugin checks abs(time() - X-HUB-Timestamp) <= 300 seconds. Any captured packet replayed after 5 minutes is discarded.
  2. Constant-Time Verification: Signatures are compared using hash_equals() in PHP and crypto.timingSafeEqual() in Node.js, completely mitigating timing side-channel attacks.
  3. Traceable Initiator Audit Log: Requests forward the initiator’s Telegram user ID and username, which are permanently logged in the WordPress plugin’s local Security Audit Log.

Related topics

WooPilot AI — Common Setup, Security, and Billing FAQsWooPilot AI: Your AI COO for WooCommerce in Telegram