tounka-webhook-ips | Stripe Developers | Page 1

charred marshBOT Apr 17, 2023, 5:21 PM

#

desert cobalt Apr 17, 2023, 5:21 PM

#

Hi 👋

#

You can examine the webhook requests sent directly and we will always use the same headers.

unreal geode Apr 17, 2023, 5:24 PM

#

got it. is the webhook signature enough or do yall typically recommend checking the IP/Origin of the request too?

desert cobalt Apr 17, 2023, 5:27 PM

#

Webhook signature verification is sufficient to validate the requests come from Stripe: https://stripe.com/docs/webhooks/signatures

charred marshBOT Apr 17, 2023, 5:27 PM

#

unreal geode Apr 17, 2023, 5:27 PM

#

got it. How often are these changed? https://stripe.com/docs/ips#webhook-notifications

gray knot Apr 17, 2023, 5:29 PM

#

@unreal geode depends on the years

#

tounka-webhook-ips

unreal geode Apr 17, 2023, 5:30 PM

#

what do you mean by that?

#

Also, is the Stripe webhook considered a CORS request?

gray knot Apr 17, 2023, 5:34 PM

#

some years we don't touch them, other years we add new ones multiple times. There isn't really a set schedule

#

And no it's a normal HTTPS request, you can't control the headers and have to allow list the IPs or do signature verification or put a secret in the URL

unreal geode Apr 17, 2023, 5:43 PM

#

do you recommend just using the webhook signautre or having the signature and an allowlist

gray knot Apr 17, 2023, 5:44 PM

#

signature is usually enough. Allow list would be more if you're worried about someone sending many fake requests and you want to guarantee the request comes from Stripe

unreal geode Apr 17, 2023, 5:47 PM

#

got it. is it possible to just allow the domain dashboard.stripe.com instead of the IP addresses?

gray knot Apr 17, 2023, 5:49 PM

#

no that doesn't make sense, the requests would not come from a URL and have nothing to do with the Dashboard

#

It's a network request, you can only allow IP addresses

unreal geode Apr 17, 2023, 5:50 PM

#

okay

#

should i use the x-real-ip header or x-forwarded-for to check for the IP?

gray knot Apr 17, 2023, 5:52 PM

#

not sure, I'd recommend trying this in Test mode, seeing real requests come in and compare

unreal geode Apr 17, 2023, 5:53 PM

#

both headers have the Stripe IP. wasn't sure if one was recommended over the other

gray knot Apr 17, 2023, 5:53 PM

#

https://security.stackexchange.com/questions/95865/difference-between-x-forwarded-for-ip-x-real-ip-vpns-and-tor

#

I would assume x-real-ip is enough unless you do some forwarding in your network

unreal geode Apr 17, 2023, 5:55 PM

#

thanks for your help!

gray knot Apr 17, 2023, 5:56 PM

#

sure thing!

#tounka-webhook-ips