Signature verification failing for Stripe events

[pjain1]

I have been using smee client to forward stripe webhook events to my local app. However, signature verification keeps on failing, I am suspecting is it due to the JSON.stringify done here that might change the payload a bit ?

[Uzlopak]

This is definetly possible.

[wolfy1339]

We have introduced a rawbody parameter in the recent iterations of the code to help with these kinds of issues.

The smee.io instance isn't controlled by us active maintainers. We'll have to reach out to get it updated.

Once the website is updated, this won't be an issue.

[pjain1]

Thanks @Uzlopak and @wolfy1339 for quick response.

It would be great to get it fixed on smee.io. Anyways, we can host our own smee.io as well but I don't see smee-client accepting and forwarding the parameter since https://github.com/probot/smee.io/pull/55 is merged.

[wolfy1339]

That is still an issue, see #320 and the linked PR

[abegehr]

For anyone running into this issue with smee.io, it turns out that stripe cli supports the web hook forwarding to localhost out-of-the-box, seee https://docs.stripe.com/webhooks#test-webhook

Receive Stripe events in your webhook endpoint

Listen to events in your Stripe account on your webhook endpoint so your integration can automatically trigger reactions.

[BottlecapDave]

I was just hit by this but for a different service. The service was sending a verification header that was processed on a payload which had an encoded character (£ to \u00a3). I believe the line https://github.com/probot/smee-client/blob/master/index.ts#L54 is causing issues when attempting to verify the payload against the header as it no longer matches.

GitHub

smee-client/index.ts at master · probot/smee-client

🔴 Receives payloads then sends them to your local server - probot/smee-client