Jimmy Felix | Stripe Developers | Page 1

solid deltaBOT May 15, 2023, 7:12 PM

#

viral panther May 15, 2023, 7:14 PM

#

Hi there

deep swan May 15, 2023, 7:14 PM

#

Hi 👋

viral panther May 15, 2023, 7:15 PM

#

Can you provide the ID of the PaymentIntent where you are seeing this?

deep swan May 15, 2023, 7:16 PM

#

pi_3N0wqKJFtSe3alJH1IOdD1q2

ch_3N0wqKJFtSe3alJH19PsqB2k

viral panther May 15, 2023, 7:22 PM

#

Thanks looking

#

Still looking

deep swan May 15, 2023, 7:28 PM

#

🙏

viral panther May 15, 2023, 7:41 PM

#

Was this just a one-off or did/are you seeing this happen with a lot of PaymentIntents?

#

We are still investigating

deep swan May 15, 2023, 7:45 PM

#

Its the only one we found in Stripe's dashobard, but we do have a spike of this -- we have lots of attempts to capture expired authorizations from may 2nd to date, but we would not attempt to capture an authorization if it had the right status

viral panther May 15, 2023, 7:45 PM

#

Yep okay thanks for bringing this to our attention.

#

I'll circle back with an update shortly

deep swan May 15, 2023, 7:46 PM

#

we'd need to know how we can recognize that an authorization expired if it's not through the status of the payment intent. Moreover, since those status didn't change as expected, we did not get the corresponding webhook calls either (payment_intent.canceled or charge.expired, neither was sent)

viral panther May 15, 2023, 7:47 PM

#

Yep this definitely looks like a bug and you should be able to rely on this status

deep swan May 15, 2023, 7:48 PM

#

For now, we're gonna catch the exception, check its stripeCode and if it's "charge_expired_for_capture", then do the same thing we did when the payment_intent's status was "canceled". But it doesn't seem like a clean solution at all

viral panther May 15, 2023, 7:48 PM

#

But yeah give us a few more minutes to look and we are escalating internally as well

deep swan May 15, 2023, 7:49 PM

#

Do you have a bug bounty? 😬

viral panther May 15, 2023, 7:51 PM

#

We do though I don't really know anything about it. You can submit a report via https://hackerone.com/stripe?type=team

deep swan May 15, 2023, 7:52 PM

#

We already submitted with you, do we still need to re-submit? 😬

viral panther May 15, 2023, 7:52 PM

#

We don't handle that program at all so yeah if you are interested in seeking a reward then you should fill that out.

#

I really don't know much about it or if this would qualify at all.

#

Sorry you hit this though -- I do understand this is not expected.

mystic jewel May 15, 2023, 7:59 PM

#

Hi there 👋 jumping in as my teammate needs to step away soon. I've got eyes on the discussions going on for this concern and will continue to provide updates.

deep swan May 15, 2023, 8:30 PM

#

Hey Toby, do you have an update?

mystic jewel May 15, 2023, 8:31 PM

#

I don't, teams are still looking.

solid deltaBOT May 15, 2023, 8:45 PM

#

mystic jewel May 15, 2023, 9:16 PM

#

I need to step away soon, but wanted to confirm this is still actively being investigated before doing so.

undone pine May 15, 2023, 9:34 PM

#

@deep swan just checking in with an update! Our team is still working on it and it'll be a while before there's a more substantive update and next steps. I recommend reaching out to our Support team about this: https://support.stripe.com/contact/

Our Support team will be able to keep you updated on our progress

Stripe: Help & Support

Find help and support for Stripe. Our support center provides answers on all types of situations, including account information, charges and refunds, and subscriptions information. Get your questions answered and find international support for Stripe.

deep swan May 15, 2023, 9:49 PM

#

hey @undone pine @mystic jewel thanks, i'll submit the issue there as well

#Jimmy Felix