kryze_

[humble steppe]

Can you elaborate on the question?

We can really just answer questions about our API usage directly. Can't advise on security/safety practices in other frameworks really

[upper junco]

On my shop application, I listen to webhook for expired order, confirmed one...
When I put nothing I got
ActionController::InvalidAuthenticityToken (Can't verify CSRF token authenticity.):
Online they said that putting this line doesn't put a risk since there is prevention with
event = Stripe::Webhook.construct_event(
payload, sig_header, endpoint_secret
)

[humble steppe]

Oh I understand

Yeah you'd need to disable csrf protection for that endpoint

        payload, sig_header, endpoint_secret
      )```
verifies the request is comfing from Stripe

[upper junco]

Okay so there is no risk doing it ?

[humble steppe]

You can't enable csrf protection on your webhook endpoint

Because we won't be able to successfully make requests to it

[upper junco]

Okay perfect ! 🙂

Thanks !