#vladislavmarinov_webhooks
pliant daggerBOT
đ Welcome to your new thread!
â˛ď¸ We'll be here soon! We typically respond in a few minutes, but in some cases we might need a bit more time (e.g., server's busy, you've got a complex question, etc.).
âąď¸ We close idle threads, which makes them read-only. Once a thread is closed it won't be reopened, but you can start a new thread if you have another question.
đ This thread will always be available, even after it's closed. You can find it again using Discord's search, or you can save this link: https://discord.com/channels/841573134531821608/1251249723797671989
đ Have more to share? Add details, code, screenshots, videos, etc. below.
light widget
const stripeUrls = [
'https://a.stripecdn.com',
'https://api.stripe.com',
'https://atlas.stripe.com',
'https://auth.stripe.com',
'https://b.stripecdn.com',
'https://billing.stripe.com',
'https://buy.stripe.com',
'https://c.stripecdn.com',
'https://checkout.stripe.com',
'https://climate.stripe.com',
'https://connect.stripe.com',
'https://dashboard.stripe.com',
'https://express.stripe.com',
'https://files.stripe.com',
'https://hooks.stripe.com',
'https://invoice.stripe.com',
'https://invoicedata.stripe.com',
'https://js.stripe.com',
'https://m.stripe.com',
'https://m.stripe.network',
'https://manage.stripe.com',
'https://pay.stripe.com',
'https://payments.stripe.com',
'https://q.stripe.com',
'https://qr.stripe.com',
'https://r.stripe.com',
'https://verify.stripe.com',
'https://stripe.com',
'https://terminal.stripe.com',
'https://uploads.stripe.com'
]; this is the full list of origins I have allowed
toxic pivot
Hi, we document the full list of IP addresses that webhook notifications may come from here: https://docs.stripe.com/ips#webhook-notifications. What you shared looks like https://docs.stripe.com/ips#stripe-domains.
light widget
I tried with all domains and all ips - nothing allowed the request
toxic pivot
Can you share the event id that was rejected? It should start with evt_123
light widget
evt_1PRUj7IOw5UGbAo18hdz03HB
most resent one
it is blocked by my API because the origin is not in the list
toxic pivot
As long as you've allowed these ips: https://docs.stripe.com/ips#webhook-notifications you should recieve these events. I'm afraid the response from that event is sent by you, "Forbidden: Access is denied" and it appears that we're able to reach your server.
light widget
what is the origin of the request
toxic pivot
That should not matter as long you'be allowed the above IP addresses and stripe domains: https://docs.stripe.com/ips#stripe-domains
light widget
10.244.1.17 that is the ip of the webhook request
it does not figure in
mb the connecting ip is 54.187.174.169
toxic pivot
Yeah, it all looks like you need to handle this on your end and respond with 200 instead of blocking the events.