zigo_webhooks

[frank tendon]

👋 Welcome to your new thread!

⏲️ We'll be here soon! Typically we respond in a few minutes, but sometimes we might take a bit longer if the server is busy or if you have a particularly tricky question.

⏱️ We close idle threads, which makes them read-only. Once a thread is closed it won't be reopened, but you can always start a new thread if you have another question.

🔗 This thread will always be available, even after it's closed. You can find it again using Discord's search, or you can save this link: https://discord.com/channels/841573134531821608/1235500319606177842

📝 Have more to share? Add more details, code, screenshots, videos, etc. below.

[formal kite]

How did you verify the signature? Could you share the code for signature verification and error message you received?

[bronze willow]

    const secret = webhookSecret;
    console.log(webhookSecret)

    const header = stripe.webhooks.generateTestHeaderString({
      payload: payloadString,
      secret,
    });
    event = stripe.webhooks.constructEvent(payloadString, header, secret);
    console.log('event_id : ' +  event.id)
    console.log('playload_id : ' +  request.body.id)```

mmaybe i can format to display code in this chat..

[bronze willow]

i have no message error..it's the probleme 🙂
I execpt an error if my webhook secret is false..no ?

[trail jasper]

If you're using stripe trigger then there's no need to use the generateTestHeaderString. The event will include a signature in the header automatically

[bronze willow]

ok, so i can test this only with url prod ?

or not..juste maybe with my apply

[trail jasper]

No you can forward events to webhook endpoint in your dev env: stripe listen --forward-to

https://docs.stripe.com/cli/listen

That will give you a unique whsec_xxx that you can use locally

[bronze willow]

ok i will try this.
Thank you !!
have a good day

[trail jasper]

No problem, glad I could help!

[bronze willow]

i'm sorry..but this time

• i don't use command trigger..
• I use my apply ( i use api so )
• i listen forward..who give me :
  Your webhook signing secret is whsec_......5fdad
• i give a false webhook secret "yhsec...." in my verif signature AND... no error

[trail jasper]

What is the code you're using where you expect to see an error?

[bronze willow]

    const secret = webhookSecret;
    console.log(webhookSecret)

    const header = stripe.webhooks.generateTestHeaderString({
      payload: payloadString,
      secret,
    });
    event = stripe.webhooks.constructEvent(payloadString, header, secret);
    console.log('event_id : ' +  event.id)
    console.log('playload_id : ' +  request.body.id)

from : https://github.com/stripe/stripe-node#webhook-signing

[trail jasper]

But why are you using generateTestHeaderString if you're using stripe listen?

You'd pass the secret from the header from the event:

const sig = request.headers['stripe-signature'];

  let event;

  try {
    event = stripe.webhooks.constructEvent(request.body, sig, endpointSecret);
  }
  catch (err) {
    response.status(400).send(`Webhook Error: ${err.message}`);
  }

See full example here: https://docs.stripe.com/webhooks?lang=node#verify-official-libraries

Also, there's no try/catch block around your code so any exception will likely be lost and not caught/thrown