Skip to content

fix(security): enhance Stripe webhook signature verification #1060

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anshul23102 wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix(security): enhance Stripe webhook signature verification #1060

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
213d3e2
fix(dependencies): update vulnerable packages to pass security audit
anshul23102 Jul 8, 2026
9071bbf
fix(dependencies): update to Next.js 15 with improved compatibility
anshul23102 Jul 8, 2026
cc08648
fix(build): resolve typecheck breakage and lockfile drift
anshul23102 Jul 8, 2026
bd1e338
fix(security): patch remaining high and moderate severity advisories
anshul23102 Jul 8, 2026
2314c21
fix(security): enhance Stripe webhook signature verification with env…
anshul23102 Jul 8, 2026
2010f34
fix(test): add logger.warn mock to Stripe webhook tests
anshul23102 Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .github/workflows/dependency_check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,10 +97,9 @@ jobs:
uses: actions/cache@v4
with:
path: .tsbuildinfo
key: ${{ runner.os }}-tsbuildinfo-${{ hashFiles('tsconfig.build.json') }}-${{ hashFiles('**/*.ts', '**/*.tsx') }}
key: ${{ runner.os }}-tsbuildinfo-${{ hashFiles('tsconfig.json', 'tsconfig.build.json') }}-${{ hashFiles('**/*.ts', '**/*.tsx') }}
restore-keys: |
${{ runner.os }}-tsbuildinfo-${{ hashFiles('tsconfig.build.json') }}-
${{ runner.os }}-tsbuildinfo-
${{ runner.os }}-tsbuildinfo-${{ hashFiles('tsconfig.json', 'tsconfig.build.json') }}-

- name: Run Type Checking
run: npm run typecheck
Expand Down
2 changes: 2 additions & 0 deletions __tests__/api/stripe-webhook.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
const createClient = jest.fn();
const loggerError = jest.fn();
const loggerInfo = jest.fn();
const loggerWarn = jest.fn();

jest.mock("@/lib/stripe", () => ({
stripe: {
Expand All @@ -34,6 +35,7 @@
logger: {
error: loggerError,
info: loggerInfo,
warn: loggerWarn,
},
}));

Expand Down Expand Up @@ -151,7 +153,7 @@
it("creates a user subscription for checkout.session.completed", async () => {
const { route, supabase } = await loadRoute();
const subscription = subscriptionFixture();
retrieveSubscription.mockResolvedValue(subscription);

Check failure on line 156 in __tests__/api/stripe-webhook.test.ts

View workflow job for this annotation

GitHub Actions / test-and-build (20.x) 

Argument of type '{ id: string; metadata: { userId: string; }; status: string; current_period_start: number; current_period_end: number; cancel_at_period_end: boolean; canceled_at: null; trial_start: null; trial_end: null; items: { ...; }; }' is not assignable to parameter of type 'never'.
constructEvent.mockReturnValue(
eventFixture("checkout.session.completed", {
metadata: { userId: "user-1" },
Expand All @@ -162,10 +164,10 @@

supabase.tableBuilders
.get("subscription_plans")!
.single.mockResolvedValue({ data: { id: "plan_123" }, error: null });

Check failure on line 167 in __tests__/api/stripe-webhook.test.ts

View workflow job for this annotation

GitHub Actions / test-and-build (20.x) 

Argument of type '{ data: { id: string; }; error: null; }' is not assignable to parameter of type 'never'.
supabase.tableBuilders
.get("user_subscriptions")!
.upsert.mockResolvedValue({ error: null });

Check failure on line 170 in __tests__/api/stripe-webhook.test.ts

View workflow job for this annotation

GitHub Actions / test-and-build (20.x) 

Argument of type '{ error: null; }' is not assignable to parameter of type 'never'.

const response = await route.POST(makeRequest());

Expand Down Expand Up @@ -205,7 +207,7 @@
);
supabase.tableBuilders
.get("stripe_webhook_events")!
.maybeSingle.mockResolvedValue({

Check failure on line 210 in __tests__/api/stripe-webhook.test.ts

View workflow job for this annotation

GitHub Actions / test-and-build (20.x) 

Argument of type '{ data: { stripe_event_id: string; }; error: null; }' is not assignable to parameter of type 'never'.
data: { stripe_event_id: "evt_checkout.session.completed" },
error: null,
});
Expand Down Expand Up @@ -237,7 +239,7 @@
);
supabase.tableBuilders
.get("stripe_webhook_events")!
.maybeSingle.mockResolvedValue({

Check failure on line 242 in __tests__/api/stripe-webhook.test.ts

View workflow job for this annotation

GitHub Actions / test-and-build (20.x) 

Argument of type '{ data: null; error: Error; }' is not assignable to parameter of type 'never'.
data: null,
error: new Error("lookup failed"),
});
Expand All @@ -261,10 +263,10 @@
);
supabase.tableBuilders
.get("subscription_plans")!
.single.mockResolvedValue({ data: { id: "plan_123" }, error: null });

Check failure on line 266 in __tests__/api/stripe-webhook.test.ts

View workflow job for this annotation

GitHub Actions / test-and-build (20.x) 

Argument of type '{ data: { id: string; }; error: null; }' is not assignable to parameter of type 'never'.
supabase.tableBuilders
.get("user_subscriptions")!
.upsert.mockResolvedValue({ error: null });

Check failure on line 269 in __tests__/api/stripe-webhook.test.ts

View workflow job for this annotation

GitHub Actions / test-and-build (20.x) 

Argument of type '{ error: null; }' is not assignable to parameter of type 'never'.

const response = await route.POST(makeRequest());

Expand Down
24 changes: 18 additions & 6 deletions app/api/webhooks/stripe/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,21 +15,33 @@ export async function POST(req: Request) {
const signature = headers().get("stripe-signature");

if (!signature) {
logger.warn(
{ route: "app/api/webhooks/stripe/route.ts" },
"Webhook request missing Stripe-Signature header"
);
return NextResponse.json({ error: "No signature" }, { status: 400 });
}

const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
if (!webhookSecret) {
logger.error(
{ route: "app/api/webhooks/stripe/route.ts" },
"STRIPE_WEBHOOK_SECRET environment variable not configured"
);
return NextResponse.json(
{ error: "Webhook configuration error" },
{ status: 500 }
);
}

let event: Stripe.Event;

try {
event = stripe.webhooks.constructEvent(
body,
signature,
process.env.STRIPE_WEBHOOK_SECRET!,
);
event = stripe.webhooks.constructEvent(body, signature, webhookSecret);
} catch (err: any) {
logger.error(
{ route: "app/api/webhooks/stripe/route.ts" },
"⚠️ Webhook signature verification failed:",
"Webhook signature verification failed:",
err.message,
);
return NextResponse.json(
Expand Down
Loading
Loading