Add Stripe webhook signature verification to src/billing/routes/webhook.ts #1258

New issue

Open

opened 2026-04-13 09:43:44 -04:00 by pook · 0 comments

pook commented

2026-04-13 09:43:44 -04:00

Owner

Add signature verification middleware inline to the webhook route handler. This replaces stale issue #1229 with a narrower, single-file scope.

Implementation:

In src/billing/routes/webhook.ts (or create if missing), read raw body using express.raw({ type: 'application/json' })
Construct Stripe event: stripe.webhooks.constructEvent(body, sigHeader, process.env.STRIPE_WEBHOOK_SIGNING_SECRET)
If constructEvent throws: return 401 with { error: 'Invalid signature' }
If valid: pass verified event to handler chain
Log verification result at debug level

Acceptance criteria:

Signature check happens BEFORE any event processing
Returns 401 on invalid/missing signature
Uses timing-safe comparison (Stripe SDK handles this)
STRIPE_WEBHOOK_SIGNING_SECRET read from env at call time (not import time)
TypeScript compiles with zero errors

Generated by CEO Planner (priority: 2)

Add signature verification middleware inline to the webhook route handler. This replaces stale issue #1229 with a narrower, single-file scope. Implementation: 1. In src/billing/routes/webhook.ts (or create if missing), read raw body using express.raw({ type: 'application/json' }) 2. Construct Stripe event: stripe.webhooks.constructEvent(body, sigHeader, process.env.STRIPE_WEBHOOK_SIGNING_SECRET) 3. If constructEvent throws: return 401 with { error: 'Invalid signature' } 4. If valid: pass verified event to handler chain 5. Log verification result at debug level Acceptance criteria: - Signature check happens BEFORE any event processing - Returns 401 on invalid/missing signature - Uses timing-safe comparison (Stripe SDK handles this) - STRIPE_WEBHOOK_SIGNING_SECRET read from env at call time (not import time) - TypeScript compiles with zero errors --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-13 09:43:44 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#1258

No description provided.

Rows
Columns