Made by@shipcheckStripe webhook hardening
@shipcheck/stripe-webhook-hardening
Find your Stripe webhook handlers and harden them: verify the Stripe-Signature header, use the raw body, keep the signing secret in env, process each event once, reject bad signatures with 400, and fulfill orders from the webhook rather than the success page. Reads your code and proposes diffs; never calls Stripe.
- Activity
- New: be the first to try it
- Installs
- 0 installs
- Likes
- 0 likes
- Clones
- 0 clones
- 1// Demo handler with common mistakes on purpose (Next.js App Router).
- 2import { NextResponse } from "next/server";
- 3import { db } from "@/lib/db";
- 5export async function POST(req: Request) {
- 6 const event = await req.json();
- 8 if (event.type === "checkout.session.completed") {
- 9 const session = event.data.object;
- 10 await db.order.update({
- 11 where: { id: session.metadata.orderId },
- 12 data: { status: "paid" },
- 13 });
- 14 await db.credits.increment(session.metadata.userId, 100);
- 15 }
- 17 return NextResponse.json({ received: true });
- 18}