Add webhook signature verify to billing routes before event processing #1249

New issue

Open

opened 2026-04-13 08:53:28 -04:00 by pook · 0 comments

pook commented

2026-04-13 08:53:28 -04:00

Owner

In the billing routes file (likely src/billing/routes.ts or similar), add Stripe webhook signature verification to the POST /api/billing/webhook endpoint:

Read STRIPE_WEBHOOK_SECRET from env
Use stripe.webhooks.constructEvent(req.body, sig, secret) to verify
Return 401 if signature verification fails
Only proceed to event processing if verified
Use the raw body — ensure express.json({ verify: ... }) captures raw body for signature check.
Acceptance: webhook endpoint verifies signature before processing, returns 401 on invalid sig, build passes. Replaces stale #1229.

Generated by CEO Planner (priority: 3)

In the billing routes file (likely src/billing/routes.ts or similar), add Stripe webhook signature verification to the POST /api/billing/webhook endpoint: 1. Read `STRIPE_WEBHOOK_SECRET` from env 2. Use `stripe.webhooks.constructEvent(req.body, sig, secret)` to verify 3. Return 401 if signature verification fails 4. Only proceed to event processing if verified Use the raw body — ensure `express.json({ verify: ... })` captures raw body for signature check. Acceptance: webhook endpoint verifies signature before processing, returns 401 on invalid sig, build passes. Replaces stale #1229. --- *Generated by CEO Planner (priority: 3)*