I finally got to the bottom of this, I had, occasionally, used an Ngrok tunnel as an endpoint for the webhook but mostly I was using localhost I didn’t realize that when you ran the Stripe CLI locally it gave you a specific signing_secret when the session started:
> Ready! You are using Stripe API Version [2020-08-27]. Your webhook signing secret is whsec_..... (^C to quit)
I was using the signing secret from another endpoint I had setup for Ngrok.
For anyone else who runs into this, the problem for me had to do with this setting in Bandit.
I was able to get around the problem by changing my config to the following.
config :my_app_web, MyAppWeb.Endpoint,
# ...
http_1_options: [max_request_line_length: 50_000]
I haven’t thought deeply about the size to use, but this got around the error I was experiencing.
I noticed that the post appears to be deleted earlier this week. Here’s a brief, working example of how to verify stripe webhooks in phoenix.
First, parsed JSON will strip some whitespace and alphabetize keys. To calculate the correct HMAC you need to stash the original unparsed request body. A small body_reader module will do it:
# body_reader.ex
defmodule MyApp.BodyReader do
def read_body(conn, _opts) do
# You may want to only do this for certain paths
with {:ok, raw_body, conn} <- Plug.Conn.read_body(conn) do
{:ok, raw_body, Plug.Conn.put_private(conn, :raw_body, raw_body)}
end
end
end
Configure Plug.Parsers to use the new body_reader module:
plug Plug.Parsers,
parsers: [:urlencoded, :multipart, :json],
pass: ["*/*"],
json_decoder: Phoenix.json_library(),
body_reader: {MyApp.BodyReader, :read_body, []}
Then define a private function to verify the signature in your controller:
defmodule MyAppWeb.StripeController do
use MyAppWeb, :controller
plug :verify_signature
# actions go here
defp verify_signature(conn, _opts) do
case get_req_header(conn, "stripe-signature") do
[header] ->
["t=" <> time, "v1=" <> sigv | _] = String.split(header, ",")
signing_secret = Application.fetch_env!(:my_app, :stripe_signing_secret)
hmac =
:hmac
|> :crypto.mac(:sha256, signing_secret, [time, ".", conn.private.raw_body])
|> Base.encode16(case: :lower)
if Plug.Crypto.secure_compare(hmac, sigv) do
conn
else
conn
|> send_resp(400, "Invalid Signature")
|> halt()
end
_ ->
conn
|> send_resp(400, "Missing Signature")
|> halt()
end
end
end
That will do it! If you test your webhook controller, which you certainly should, you’ll need to inject a signature as well. The signature below is fake and computed using a test signing key (whsec_test), a fake timestamp, and :raw_body:
@signature "t=123456789,v1=34e0846d2ae20d2fcde8c391d069223f72d0518eaf511de69f785470938e1505"
setup %{conn: conn} do
conn =
conn
|> put_req_header("stripe-signature", @signature)
|> put_private(:raw_body, ~s({"fake":"body"}))
{:ok, conn: conn}
end
Just a quick note about testing the body_reader that took me a while to figure out. I had a hard time just getting the custom body reader to run in controller tests until I realized the following:
content-type header, andMy test ended up looking something like:
test "invalid hmac signature", %{conn: conn} do
conn =
conn
|> Plug.Conn.put_req_header("content-type", "application/json")
|> post(~p"/api/webhooks", "{}")
assert response(conn, 400) == "Invalid signature"
end
Hope that helps someone stop banging their head on the desk as much as I did!