#someone

1 messages · Page 1 of 1 (latest)

sly steppeBOT
mental basin
#

Hello, the webhook secret and body are the two things that cause that error. If your webhook secret is still correct then it sounds like your body is still getting modified in some way

jade wind
#

can it be because of test mode?

mental basin
#

Have you double checked that your secret variable is populated to the secret key that you are expecting for this specific endpoint (each endpoint and CLI endpoints have a different secret(

#

Nope, this code works in test mode with the proper secret and body

jade wind
#

i will check if secret is ok

jade wind
#

yeah secret key's good

mental basin
#

Thanks for checking. Sounds like the issue is likely still that you need to get the raw request body.

#

Oh, I now see that you are calling json stringify on the request body that you are passing in to the contruct event function. Can you try sending the body in by itself with no modification?

#

Using json parsers will mess with our request body as even the whitespace is counted when making the signature you are verifying against

jade wind
mental basin
#

Gotcha, unfortunately that means it is still being modified in some way though it is hard to say how. Is there any middleware that may be modifying the request vody before your code gets to it?

jade wind
#

nope

sly steppeBOT
jade wind
#

hi

rugged yew
#

👋

#

Anything you still need help with?

#

Okay so seems like you are still having a signature verification issue?

#

Can you share your full webhook handler code?

jade wind
#

wait a sec

rugged yew
#

Can you show me your express initialization

#

Are you using express.json()?

jade wind
rugged yew
#

When you log out request.body what do you see?

#

Is it JSON?

#

Or do you see a buffer (looks like binary)?

jade wind
#

yeah wait

rugged yew
#

Ah okay cool

#

So then the raw request body isn't the issue

#

So what is the exact error you see?

#

Do you have an example event I can look at as well that you tested with?

jade wind
#

yeah i will send ss

#

or link

rugged yew
#

I need an Event ID

#

Looks like evt_xxxx

jade wind
#

evt_3Myd4RDnC20fs5eD2xCNavOP

rugged yew
#

Ah you are forwarding via the CLI?

jade wind
#

yes

rugged yew
#

Okay and you are using the webhook secret that the CLI provided you when you run stripe listen

jade wind
#

yes

sly steppeBOT
rugged yew
#

Can you show me what you see in the CLI for the error?

jade wind
broken veldt
#

Hi there 👋 taking over, as my colleague needs to step away

Give me a few minutes to get caught up.

jade wind
#

ok

broken veldt
#

It looks like your server isn't sending back a 200 response, which usually means that you're forwarding requests to an endpoint on your server that is misconfigured or nonexistent.

jade wind
#

yes

#

i guess its because of problem i have with verification

broken veldt
#

Do you have your server running in another terminal instance? If so, is it logging the error?

jade wind
#

yes

#

i sended it before

broken veldt
jade wind
#

my code is based on it

broken veldt
#

I was just about to mention that I saw the screenshot you posted of your code. Do you know exactly which line in the try block is throwing the error?

jade wind
broken veldt
#

Well yeah, but it is trying to execute each line of code in the try side of the try/catch block first, so which line from the try is throwing an exception?

jade wind
#

i guess this one

image.png
broken veldt
#

I would recommend putting a console.log(); after each line to make sure you know for sure first

jade wind
#

ok wait

broken veldt
#

Okay, so it's the line where you call stripe.webhooks.generateTestHeaderString(). What are you actually trying to do with that line? I don't see it in our docs, so I assume you saw it somewhere else and that's why it's there?

jade wind
broken veldt
#

Ahhh, okay. Let's start by commenting out that line and see if you can get a 200 back to Stripe CLI

jade wind
broken veldt
#

On the first line of the webhook handler, you use bodyParser.raw() instead of express.raw(). I wonder if that's manipulating the raw header you need to verify against.

jade wind
#

still the same

image.png
#

i have changed it to express.raw and still same thing

broken veldt
#

huh... I'm running out of idead.

jade wind
broken veldt
#

Let me get mine up and running. Just a sec

#

If you click on it, does it show you the exact same signing secret that you've copy-pasted into your code?

jade wind
#

yes

sly steppeBOT
gaunt fjord
#

Hey there, can you explain why you're paying this JSON.stringify output? Does the result change if you pass in request.body directly? Looking at the past messages its not clear if this was the original state so sorry if that the case.

jade wind
#

i forgot to remove it

gaunt fjord
#

Also as we move forward please use code snippets of text copied rather than images, use triple-backticks like this:

multi
line
code
jade wind
#

ok

#

you could just say to paste my code in here 😅

gaunt fjord
#

Yes, do that please 🙂

jade wind
# 
    console.log(payload)

    let event;

    try {
        console.log(1)
        const sig = request.headers['stripe-signature'];
        console.log(2)
        event = stripe.webhooks.constructEvent(request.body, sig, endpointSecret);
    } catch (err) {
        console.log(`Webhook Error: ${err.message}`)
        return response.status(400).send(`Webhook Error: ${err.message}`);
    }

    if (event.type === 'checkout.session.completed') {
        const sessionWithLineItems = await stripe.checkout.sessions.retrieve(
            session.id,
            {
                expand: ['line_items'],
            }
        );
        const lineItems = session.line_items;

        fulfillOrder(lineItems);
    }

    response.status(200).end();```
gaunt fjord
#

I checked the images, its just a bit harder to review/reference

#

Can you remove the additional reference to request.body: const payload = request.body;
if thats not needed

#

and i want to confirm that you set endpointSecret to the secret shown in the listen command output, NOT any secret from your dashboard

jade wind
#

so that was the whole problem

#

in docs they said that i have to paste secret from dashboard

gaunt fjord
#

Fantastic!

#

Where do you see that?

#

It is likely refering to building an online endpoint we send to directly, which does need the endpoint secret from the dashboard

#

but when testing locally with the forward-to option you need to use the CLI listen secret

jade wind
#

ok

#

nice

#

thanks guys

gaunt fjord
#

stripe listen --forward-to localhost:4242/stripe_webhooks

Output
Ready! Your webhook signing secret is '{{WEBHOOK_SIGNING_SECRET}}' (^C to quit)

jade wind
#

yeah maybe i misunderstood something

gaunt fjord
#

It's possible, but glad we sorted it out 🙂

jade wind
#

yeah

#

thanks again and have a nice evening

gaunt fjord
#

you too, my pleasure