#mecha-chocobo_webhooks
drifting finchBOT
👋 Welcome to your new thread!
⏲️ We'll be here soon! We typically respond in a few minutes, but in some cases we might need a bit more time (e.g., server's busy, you've got a complex question, etc.).
⏱️ We close idle threads, which makes them read-only. Once a thread is closed it won't be reopened, but you can start a new thread if you have another question.
🔗 This thread will always be available, even after it's closed. You can find it again using Discord's search, or you can save this link: https://discord.com/channels/841573134531821608/1253431217877942313
📝 Have more to share? Add details, code, screenshots, videos, etc. below.
ember ermineBOT
drowsy hawk
Hi there 👋 I don't really understand the question here. Can you elaborate on what you're referring to when you say you want to verify a webhook event's IP address?
ocean musk
I'm trying to implement webhook support on my project, and part of the instructions around verifying events calls out to "Only trust events coming from these IP addresses", with a link to the IPs that webhooks should be coming from
drowsy hawk
Yup, but if you forward the Event using the Stripe CLI, the request that is hitting your endpoint is no longer coming from our servers. At that point the CLI is the one sending the Event to your webhook endpoint, so I'd expect you to see the IP address of the machine where you're running the Stripe CLI.
ocean musk
That's what I figured was happening. The issue then becomes how I'm supposed to test webhooks locally? If I have the IP check, it's going to fail in local tests where I need to use the CLI to forward the events
drowsy hawk
I'd suggest either you add your local IP to the supported list of IP addresses for your testing, or you don't have the IP check in place for flows that require the use of the CLI for testing.
ocean musk
My concern with that latter option is "flows the that require the use of the CLI for testing" would be the whole webhook flow
at which point, the guidance to verify the IP address is kind of lost
drowsy hawk
Hm, not sure I agree. You can create a webhook endpoint in testmode and not use the CLI to forward Events to it. I typically think of the CLI being more for active development of your endpoint, rather than being for continual ongoing testing like regression testing. I think it'd also be fine to not have IP checks for those active developments, because I'd expect that'd be done on a server typically not receiving real traffic.
ocean musk
ok, I'll try some more stuff with this. Thanks for your help!