pook/compliancebot

Add Stripe webhook raw body preservation for payment verification #71

New issue

Closed

opened 2026-04-08 16:51:28 -04:00 by pook · 1 comment

pook commented

2026-04-08 16:51:28 -04:00

Owner

ComplianceBot has a Stripe webhook handler (#53) and idempotency guard (#61) in progress, but without raw body preservation, signature verification will fail silently in production, blocking all paid document unlocks.

Configure Express to preserve the raw request body buffer on the Stripe webhook route using express.raw() or the verify callback approach
Ensure the webhook handler passes the raw buffer (not parsed JSON) to stripe.webhooks.constructEvent()
Add a test with a mock Stripe payload that verifies the signature check passes with correct secret and fails with wrong secret

Acceptance criteria:

Webhook route receives raw buffer for signature verification
Other routes are unaffected (still use normal JSON parsing)
Test covers both valid and invalid signature scenarios

Generated by CEO Planner (priority: 2)

ComplianceBot has a Stripe webhook handler (#53) and idempotency guard (#61) in progress, but without raw body preservation, signature verification will fail silently in production, blocking all paid document unlocks. 1. Configure Express to preserve the raw request body buffer on the Stripe webhook route using `express.raw()` or the `verify` callback approach 2. Ensure the webhook handler passes the raw buffer (not parsed JSON) to `stripe.webhooks.constructEvent()` 3. Add a test with a mock Stripe payload that verifies the signature check passes with correct secret and fails with wrong secret Acceptance criteria: - Webhook route receives raw buffer for signature verification - Other routes are unaffected (still use normal JSON parsing) - Test covers both valid and invalid signature scenarios --- *Generated by CEO Planner (priority: 2)*

pook added the

label

2026-04-08 16:51:28 -04:00

pook referenced this issue

2026-04-08 17:19:28 -04:00

Add Stripe webhook raw body preservation middleware for payment verification #78

pook referenced this issue from a commit

2026-04-08 17:30:42 -04:00

feat: preserve raw request body as Buffer for Stripe webhook signature verification

pook referenced this issue from a pull request that will close it,

2026-04-08 17:30:53 -04:00

feat: preserve raw body buffer for Stripe webhook signature verification #81

pook referenced this issue

2026-04-08 17:34:16 -04:00

Add Stripe webhook raw body preservation before JSON parser middleware #83

pook referenced this issue from a commit

2026-04-08 17:41:17 -04:00

fix: preserve raw body bytes for Stripe webhook signature verification

pook referenced this issue from a pull request that will close it,

2026-04-08 17:41:37 -04:00

fix: preserve raw body bytes for Stripe webhook signature verification #85

pook referenced this issue

2026-04-08 17:45:46 -04:00

Add Stripe webhook raw body preservation middleware before JSON parser #87

pook referenced this issue from a commit

2026-04-08 17:50:04 -04:00

fix: preserve raw body bytes for Stripe webhook signature verification

pook referenced this issue

2026-04-08 17:50:16 -04:00

fix: preserve raw body bytes for Stripe webhook signature verification #89

pook referenced this issue

2026-04-08 17:53:01 -04:00

Close duplicate Stripe raw-body preservation issues and merge best PR #91

pook commented

2026-04-08 17:57:54 -04:00

Author

Owner

Closing as duplicate of #87. Fix is tracked in PR #85.

Closing as duplicate of #87. Fix is tracked in PR #85.

pook closed this issue

2026-04-08 17:57:54 -04:00

pook referenced this issue

2026-04-08 17:58:02 -04:00

fix: preserve raw body bytes for Stripe webhook signature verification #85

Sign in to join this conversation.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#71

No description provided.