Made by@shipcheckStripe webhook hardening
@shipcheck/stripe-webhook-hardening
Find your Stripe webhook handlers and harden them: verify the Stripe-Signature header, use the raw body, keep the signing secret in env, process each event once, reject bad signatures with 400, and fulfill orders from the webhook rather than the success page. Reads your code and proposes diffs; never calls Stripe.
- Activity
- New: be the first to try it
- Installs
- 0 installs
- Likes
- 0 likes
- Clones
- 0 clones
- 1// Demo handler done right (Express). The secret comes from the environment.
- 2import express from "express";
- 3import Stripe from "stripe";
- 4import { db } from "./db.js";
- 6const env = process.env;
- 7const stripe = new Stripe(env.STRIPE_SECRET_KEY);
- 8const router = express.Router();
- 10router.post("/webhooks/stripe", express.raw({ type: "application/json" }), async (req, res) => {
- 11 let event;
- 12 try {
- 13 event = stripe.webhooks.constructEvent(req.body, req.headers["stripe-signature"], env.STRIPE_WEBHOOK_SECRET);
- 14 } catch (err) {
- 15 return res.status(400).send(`Webhook signature failed: ${err.message}`);
- 16 }
- 18 // Idempotency: the unique key on processed_events.id stops double processing.
- 19 const fresh = await db.query(
- 20 "insert into processed_events (id) values ($1) on conflict do nothing returning id",
- 21 [event.id],
- 22 );
- 23 if (fresh.rowCount === 0) return res.json({ received: true, duplicate: true });
- 25 switch (event.type) {
- 26 case "checkout.session.completed":
- 27 await db.query("update orders set status = 'paid' where stripe_session_id = $1", [event.data.object.id]);
- 28 break;
- 29 default:
- 30 break;
- 31 }
- 32 res.json({ received: true });
- 33});
- 35export default router;