#IsmailSarikaya-webhook signature
unkempt moth
sure
Did you see something wrong? I actually got this code structure directly from Stripe's web site.
steel thunder
I'm taking a look
unkempt moth
Great, thanks.
steel thunder
so basically I saw something but I'm not sure whether it's related or not
you're using Request.Headers["Stripe-Signature"] instead of HttpContext.Request.Headers["Stripe-Signature"]
unkempt moth
I didn't write these parts on my own. Is this the correct one? HttpContext.Request.Headers["Stripe-Signature"]
steel thunder
I'm not sure
I don't have a full look at your code base
I don't know if Request is something that is exposed in your BaseController or what exactly
unkempt moth
Take a look at this:
https://stripe.com/docs/webhooks
There:
var stripeEvent = EventUtility.ParseEvent(json);
steel thunder
yes
just take a look at this https://stripe.com/docs/webhooks/quickstart
and try to make it as much the same as possible
that's my best guess for you
unkempt moth
Yes, I agree with you. But I am trying to understand if 'Stripe-Signature' must be used?
Because in the example that I mentioned, there is no header, they parsed directly from json but in you example they used signature.
And in my example, they didn't use endpointSecret. I am confused.
steel thunder
in that code they are not verifying the signature
it's important to verify the signature so that you can't be attacked since you're exposing your API on the internet
unkempt moth
You say it's for the security? So at my own risk, does it work if I don't use it?
steel thunder
yes
unkempt moth
Then I will try without it until the final product release.
steel thunder
oh wait
you're missing this var stripeEvent = EventUtility.ParseEvent(json); from your code
you need those three lines
var stripeEvent = EventUtility.ParseEvent(json);
var signatureHeader = Request.Headers["Stripe-Signature"];
stripeEvent = EventUtility.ConstructEvent(json,
signatureHeader, endpointSecret);```in your code your only using var stripeEvent = EventUtility.ConstructEvent(json, Request.Headers["Stripe-Signature"], endpointSecret); which passes the json without parsing it first
unkempt moth
Ok I will try this and let you know. Thanks.