aichallengesafrica

Take a challenge

Home Challenges Reps Problems Leaderboard Take a challenge

Payment Webhook State Machine

A public URL that trusts anything POSTed to it, holds the gateway open for three seconds, and hardcodes its secret.

Advanced45 min on the clock6 graded checks · 100 pointsASP.NET Core RefactorPro

Graded by reading your code against the checklist below.

What you build

Verify the HMAC-SHA256 signature before reading the payload
Reject a bad signature with 401 and process nothing
Bind the signing secret with IOptions<T> instead of a literal
Transition the payment through its own domain method, then save
Answer the gateway promptly — a slow 200 becomes a retry storm

Done means

A forged call gets 401 and changes nothing; a genuine one transitions the payment and returns quickly.

How it is graded

Published in full, before you start — every point is one of these and there is nothing else.

The signature is verified with HMAC-SHA256+30Trusting a call you did not make
A bad signature gets 401 and stops there+15Trusting a call you did not make
The secret comes from IOptions<T>+25Settings, not string literals
No signing secret is left in the source+10Settings, not string literals
The payment transitions through its domain method+10Querying a database
The gateway is not held open+10Rate limiting and cancellation

What it teaches

Trusting a call you did not makeadvanced

A webhook endpoint is a public URL anyone can POST to; verifying the provider's HMAC signature before you read the payload is the only thing separating a real event from a forged one.

Settings, not string literalsintermediate

A hardcoded API secret is a secret in your git history; IOptions<T> binds configuration into a typed object your code asks for like anything else.

Querying a databaseintermediate

IQueryable lets you build a query in pieces and send one efficient SQL statement — the classic mistake is fetching every row into memory and filtering there.

Rate limiting and cancellationadvanced

A proxy in front of a paid API needs a rate limit or one user can spend your whole budget, and a cancellation token so a closed browser tab stops the work.

The rest of ASP.NET Core Refactor

Auth APIIntermediate · 25 min CRUD + PaginationIntermediate · 20 min AI Streaming EndpointAdvanced · 25 min Vertical Slice RefactorIntermediate · 30 min Domain Model Security GuardIntermediate · 20 min Verifying What The Browser ClaimsIntermediate · 25 min