pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

fix: preserve raw body bytes for Stripe webhook signature verification #89

Closed
pook wants to merge 1 commit from fix/stripe-webhook-raw-body into main
pull from: fix/stripe-webhook-raw-body
merge into: pook:main
Conversation 2 Commits 1 Files changed 2 +172 -1
pook commented 2026-04-08 17:50:16 -04:00
Owner
Copy link

Summary

  • Use Buffer.from(arrayBuffer) instead of c.req.text() in the Stripe webhook handler to ensure byte-perfect raw body preservation for signature verification
  • c.req.text() decodes the body to a UTF-8 string, which can alter bytes and break HMAC-SHA256 signature matching. Using c.req.arrayBuffer() preserves the exact bytes Stripe signed.
  • Added integration tests covering: missing signature header, tampered body, bogus signature, valid signature, and unicode payload preservation

Test plan

  • Run bun test packages/api/tests/e2e/webhook.test.ts with STRIPE_WEBHOOK_SECRET=whsec_test_secret_for_integration_tests
  • Verify existing billing routes still parse JSON bodies correctly
  • Test with real Stripe webhook in staging environment

Closes #83, #78, #71

🤖 Generated with Claude Code

## Summary - Use `Buffer.from(arrayBuffer)` instead of `c.req.text()` in the Stripe webhook handler to ensure byte-perfect raw body preservation for signature verification - `c.req.text()` decodes the body to a UTF-8 string, which can alter bytes and break HMAC-SHA256 signature matching. Using `c.req.arrayBuffer()` preserves the exact bytes Stripe signed. - Added integration tests covering: missing signature header, tampered body, bogus signature, valid signature, and unicode payload preservation ## Test plan - [ ] Run `bun test packages/api/tests/e2e/webhook.test.ts` with `STRIPE_WEBHOOK_SECRET=whsec_test_secret_for_integration_tests` - [ ] Verify existing billing routes still parse JSON bodies correctly - [ ] Test with real Stripe webhook in staging environment Closes #83, #78, #71 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix: preserve raw body bytes for Stripe webhook signature verification
Some checks are pending
agent-worker/pr-tests Running PR tests...
81feceab02 
Use Buffer.from(arrayBuffer) instead of c.req.text() to ensure
byte-perfect raw body preservation for Stripe signature verification.
Add integration tests covering valid signature, tampered body, missing
header, and bogus signature scenarios.

Closes #83, #78, #71

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pook commented 2026-04-08 17:50:29 -04:00
Author
Owner
Copy link

⚠️ No Test Suite Detected

Commit: 81feceab

No test script found in package.json. Add a test script to enable automated testing.

## ⚠️ No Test Suite Detected **Commit:** `81feceab` No `test` script found in `package.json`. Add a test script to enable automated testing.
pook commented 2026-04-08 17:57:34 -04:00
Author
Owner
Copy link

Closing as duplicate of #85, which has the same fix (Buffer.from(await c.req.arrayBuffer())) plus more comprehensive test coverage (9 tests vs 5). See #87 for the canonical issue.

Closing as duplicate of #85, which has the same fix (`Buffer.from(await c.req.arrayBuffer())`) plus more comprehensive test coverage (9 tests vs 5). See #87 for the canonical issue.
pook closed this pull request 2026-04-08 17:57:34 -04:00
Some checks are pending
agent-worker/pr-tests Running PR tests...

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!89
No description provided.