CODEWITHSUNDEEP
node.jstypescriptfirebasegoogle-cloud-functionsstripe-payments
Ajit Goel
Ajit Goel

Reputation: 4418

Listen to Stripe Webhooks using Firebase Functions and Node.js

I've been trying to listen to Stripe webhooks with firebase functions. here is my code:

exports.stripeEvents = functions.https.onRequest((request, response) => 
{
  try
  {    
    const stripesignature = request.headers['stripe-signature'] as string;
    let stripeevent:Stripe.Event;
    try 
    {
      stripeevent = stripe.webhooks.constructEvent(request.rawBody, stripesignature, config.stripewebhooksecretkey);
    } 
    catch (error) 
    {
      sentry.captureException(error);  
      response.status(400).end();
      return;
    } 
    
    response.sendStatus(200);
  }
  catch(error)
  {
    sentry.captureException(error);
    throw error;
  }
});

and I keep getting this error:

No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe? https://github.com/stripe/stripe-node#webhook-signing

I have tried changing request.rawBody to request.rawBody.toString() but of no avail. The same firebase function works perfectly when I do a test webhook run from the stripe website. What could I be missing?

Stripe official documentation on how to do it: https://stripe.com/docs/webhooks/signatures

enter image description here

Upvotes: 0

Views: 1114

Answers (1)

ed2
ed2

Reputation: 1497

This may not be an immediate solution, but here are a few suggestions to try:

  1. Check whether changing const stripesignature to a variable produces different behaviour
  2. Log the values of all 3 inputs immediately before that line, then inspect to determine if they are as anticipated (or a substring of each instead, for the more security-minded)

See if you can narrow it down to which input is causing the issue (e.g. request.rawBody, or stripesignature).

On the other hand, although an incorrect webhook secret would be expected to produce a different error, there may be little harm checking it is propagating correctly from config and matching the one in the configured endpoint setting in the dashboard.

Upvotes: 0

Related Questions