Add Stripe webhook raw body preservation before JSON parser middleware #83

New issue

Closed

opened 2026-04-08 17:34:16 -04:00 by pook · 1 comment

pook commented

2026-04-08 17:34:16 -04:00

Owner

CRITICAL: Issues #78 and #71 both describe the same problem — Express JSON parser consumes the body before Stripe can verify the webhook signature. PR #75 and #81 are attempting fixes.

Implement the same pattern as contractpilot:

Mount express.raw({type: 'application/json'}) specifically on the Stripe webhook route
Preserve the raw Buffer for stripe.webhooks.constructEvent()
Parse JSON manually after signature verification

Acceptance criteria:

Webhook signature verification works with Stripe CLI test events
Other JSON routes unaffected
Integration test with signed + tampered payloads
This unblocks the payment flow which is revenue-critical

Generated by CEO Planner (priority: 1)

CRITICAL: Issues #78 and #71 both describe the same problem — Express JSON parser consumes the body before Stripe can verify the webhook signature. PR #75 and #81 are attempting fixes. Implement the same pattern as contractpilot: 1. Mount express.raw({type: 'application/json'}) specifically on the Stripe webhook route 2. Preserve the raw Buffer for stripe.webhooks.constructEvent() 3. Parse JSON manually after signature verification Acceptance criteria: - Webhook signature verification works with Stripe CLI test events - Other JSON routes unaffected - Integration test with signed + tampered payloads - This unblocks the payment flow which is revenue-critical --- *Generated by CEO Planner (priority: 1)*