From d7db9733974faf074e23a3d9e3d09f1b7b53cbcf Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Fri, 12 Sep 2025 16:01:11 +0200
Subject: [PATCH] Use the same timestamp from the body in the header

Else replay attack prevention doesn't work
---
 app/models/webhook/delivery.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/models/webhook/delivery.rb b/app/models/webhook/delivery.rb
index 9c6ee975e..f53d1f8cf 100644
--- a/app/models/webhook/delivery.rb
+++ b/app/models/webhook/delivery.rb
@@ -97,7 +97,7 @@ class Webhook::Delivery < ApplicationRecord
         "User-Agent" => USER_AGENT,
         "Content-Type" => "application/json",
         "X-Webhook-Signature" => signature,
-        "X-Webhook-Timestamp" => Time.current.utc.iso8601
+        "X-Webhook-Timestamp" => event.created_at.utc.iso8601
       }
     end