Genazvale | Stripe Developers | Page 1

wheat fractalBOT Feb 23, 2023, 12:50 PM

#

cerulean egret Feb 23, 2023, 12:50 PM

#

Hi there!

#

Can you share the webhook endpoint ID (we_xxx)? And what do you mean by "flood" exactly?

latent mountain Feb 23, 2023, 1:01 PM

#

it's we_1DyFadKFgWVc4PH5UTYl2Z8a.
On the screenshot is what I mean by flood. To many requests in a short period of time.

cerulean egret Feb 23, 2023, 1:05 PM

#

This webhook endpoint is listening to ALL events. Do you really need this?

#

You should only listen to the events you actually need.

latent mountain Feb 23, 2023, 1:11 PM

#

cerulean egret You should only listen to the events you actually need.

Thanks! Makes sense, but there're too many, I'm not sure which ones to keep. Anyways, it's not a problem. I didn't have any issues in a few years, until yesterday. It looks like DDoS attack.

cerulean egret Feb 23, 2023, 1:14 PM

#

Looks like your server failed, which means Stripe retried to send the events, which made your sever fail even more.
The solution is to only listen to events you actually need. Usually less than 10 is enough.

latent mountain Feb 23, 2023, 1:19 PM

#

cerulean egret Looks like your server failed, which means Stripe retried to send the events, wh...

It won't help, there're only two events in the list.
customer.created
payment_method.attached
Even if I keep only two of them (and they are essential), it would still be the same.
The server failed because I blocked them, because they killed the server.

cerulean egret Feb 23, 2023, 1:24 PM

#

So what is your end goal here? Disable this webhook? Stop the retry events from the webhook? Something else?

#

If you blocked requests from your server, it's expected that all events are failing and will be retried by Stripe.

latent mountain Feb 23, 2023, 1:27 PM

#

right. The goal is to get rid of those requests. It's like a DDoS - every second a few fake payments requests created, which creates tons of requests for the server, which goes down because of them. If I block them to keep the server alive (which is the only way for now), then real payments won't go through. So the goal is to stop them somehow or filter fake from real ones, or something like that.

cerulean egret Feb 23, 2023, 1:28 PM

#

The goal is to get rid of those requests.
Then just delete the webhook endpoint and re-create a new one.

latent mountain Feb 23, 2023, 1:29 PM

#

then they will go to the new one, no?

cerulean egret Feb 23, 2023, 1:31 PM

#

No, you will get only the new events I think.

latent mountain Feb 23, 2023, 1:32 PM

#

cerulean egret No, you will get only the new events I think.

May work, thank you! But also, how do I delete the endpoint? I don't see this option in "Update details". Should I recreate the entire webhook?

#

Is this what you mean? Add endpoint?

cerulean egret Feb 23, 2023, 1:35 PM

#

You can disable the existing webhook endpoint, and then create a new one.

latent mountain Feb 23, 2023, 1:36 PM

#

Thanks! Won't it hurt new real payments?

#

Also, I have to set the url. If I use the same url, it won't help, right? Because nothing will change for the requests. So I have to set another url?

cerulean egret Feb 23, 2023, 1:40 PM

#

For new payments you will recieve the events to your new webhook endpoint. The issue is for past payments that were sent to your server but your server responded with an error. So you'll need to check those.

latent mountain Feb 23, 2023, 1:40 PM

#

Not really. I'm still getting them every second.

cerulean egret Feb 23, 2023, 1:42 PM

#

Give me a few minutes to look into this.

#

Did you disable the existing webhook endpoint and create a new one?

latent mountain Feb 23, 2023, 1:44 PM

#

https://tenor.com/view/spongebob-worship-worshipping-now-bowing-gif-12297363

Tenor

latent mountain Feb 23, 2023, 1:45 PM

#

cerulean egret Did you disable the existing webhook endpoint and create a new one?

not yet. I'm not sure how to deal with the url. If I keep old one, they will still come there, if I change it, I'm not sure the real payments will work.

cerulean egret Feb 23, 2023, 1:46 PM

#

You should keep the same URL, since your code that handle webhook events is there.

latent mountain Feb 23, 2023, 1:49 PM

#

ok, disabled the old one.

#

how can I test if it works?

cerulean egret Feb 23, 2023, 1:53 PM

#

Did you create the new webhook endpoint?

latent mountain Feb 23, 2023, 1:58 PM

#

Yes.

cerulean egret Feb 23, 2023, 2:14 PM

#

So is it working?

latent mountain Feb 23, 2023, 2:31 PM

#

How do I know 🤷

#

Need to make a real payment to check?

molten fog Feb 23, 2023, 2:38 PM

#

If you changed this is test mode too you can create a payment in test mode

#

Live mode would depend on the events you set up

#

You might need to wait for a payment

latent mountain Feb 23, 2023, 3:09 PM

#

Ok, guys, it didn't help at all, all the new requests keep flooding the new web hook, which was expected, because the link is the same.
Anyone have other ideas?
Also, how can I reach out to stripe support? There are no any options on the website.
Thanks!

molten fog Feb 23, 2023, 3:15 PM

#

Well what do you mean, whats the issue?

#

Did you change the webhook configuration?

#

https://dashboard.stripe.com/webhooks/we_1Mef9vKFgWVc4PH52VPHAIAJ

Stripe Login | Sign in to the Stripe Dashboard

Sign in to the Stripe Dashboard to manage business payments and operations in your account. Manage payments and refunds, respond to disputes and more.

#

YOu set this up with almost 200 event types, why?

#

You should only listen for the events you need in your application

#

Yes, if you subscribe to all those event types you'll... get a lot of events

latent mountain Feb 23, 2023, 3:23 PM

#

molten fog You should only listen for the events you need in your application

Thanks! As I told earlier, I'm getting only two events and they are essential - customer created, and payment method attached.
Every second I'm getting like 5 new customers.
It's not a bug or issue, it's an attack.

molten fog Feb 23, 2023, 3:27 PM

#

Ok, you need to implement controls on your customer attach and payment endpoints:
https://stripe.com/docs/disputes/prevention/card-testing#implement-controls

Protect yourself from card testing

Learn about this fraudulent activity and how to protect yourself against it.

#

add captchas, require auth, use rate limits, etc

latent mountain Feb 23, 2023, 3:31 PM

#

Nope, it's not that. No one actually make payments. I don't even have stripe on my website, I accept payments through a third party (thrivecart). I'm just getting tons of requests to the webhook url. Thousands.
It's not card testing.

molten fog Feb 23, 2023, 3:35 PM

#

Ok then you will need to speak to ThriveCart about these requests since yes they are coming from their platform

#

Whoops, sorry, Didn't mean to lock

latent mountain Feb 23, 2023, 3:36 PM

#

no, they are not from there.

#

Check out this server log. That's what is happening.

#

cPanel_-_Visitors_and__Genazvale____Stripe_Developers_-_Discord.jpg

molten fog Feb 23, 2023, 3:38 PM

#

The requests the lead to these events are: https://dashboard.stripe.com/logs/req_KbVuBTRK0lZMjT

#

You can look over your logs to see other example requests

latent mountain Feb 23, 2023, 3:43 PM

#

Yes, I saw them. They have different responses. From card declined to wrong amount.

molten fog Feb 23, 2023, 3:43 PM

#

Sure, but these are requests from the paltform, they can be invalid for many reasons

#

but these are what are leading to your event flood

latent mountain Feb 23, 2023, 3:44 PM

#

what? I don't understand, sorry. 🙂

#

they all have Thrivecart, you're right.

molten fog Feb 23, 2023, 3:50 PM

#

Yes

#

Your first order issue is an overwhelmed webhook endpoint

#

This is because its getting a lot of events

#

These events are related to lots of requests

#

Those requests are coming from the platform you're connected to

latent mountain Feb 23, 2023, 3:57 PM

#

got it, thank you. But how it can be? How can they come from the platform? Like "someone" (bot) is filling out my payment form on their website?

molten fog Feb 23, 2023, 3:59 PM

#

More or less, yes, these are requests enabled by the platform -- I can only speculate on their origins

latent mountain Feb 23, 2023, 4:02 PM

#

well, is it like DDoS but on the payment gateway, rather than on the website?

#Genazvale