Or have a webhook endpoint per secret?
Nov 20, 2023
5
Level 10
Stripe webhook validation with multiple secrets
I'm working on an application that has multiple stripe webhook routes, and consequently multiple webhook secrets. In the Stripe documentation, they have the following snippet to verify the authenticity of the POST request:
$endpoint_secret = 'whsec_...';
$payload = @file_get_contents('php://input');
$sig_header = $_SERVER['HTTP_STRIPE_SIGNATURE'];
$event = null;
try {
$event = \Stripe\Webhook::constructEvent(
$payload, $sig_header, $endpoint_secret
);
} catch(\UnexpectedValueException $e) {
// Invalid payload
http_response_code(400);
echo json_encode(['Error parsing payload: ' => $e->getMessage()]);
exit();
} catch(\Stripe\Exception\SignatureVerificationException $e) {
// Invalid signature
http_response_code(400);
echo json_encode(['Error verifying webhook signature: ' => $e->getMessage()]);
exit();
}
The problem is that the constructEvent function assumes there's only one webhook secret to try, and then throws an exception. Is there any way I could loop through my webhook secrets until the correct value is found, and throw the Exception only if none are matching? I'd like to keep the validation in a single middleware.
Please or to participate in this conversation.