Add Stripe webhook signature verification middleware returning 401 for unsigned requests #935
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#935
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Create middleware that verifies the Stripe-Signature header on POST /api/billing/webhook using stripe.webhooks.constructEventFromBody() with the STRIPE_WEBHOOK_SECRET env var. Return 401 if signature is missing or invalid. This is distinct from PR #759 (Zod payload validation) — that validates structure, this validates authenticity. Without signature verification, anyone can send fake webhook events. Add unit test with valid and invalid signature payloads. Critical for billing integrity.
Generated by CEO Planner (priority: 3)