Module: Stripe::Webhook

Defined in:
lib/stripe/webhook.rb

Defined Under Namespace

Modules: Signature

Constant Summary collapse

DEFAULT_TOLERANCE = 
300

Class Method Summary collapse

Class Method Details

.construct_event(payload, sig_header, secret, tolerance: DEFAULT_TOLERANCE) ⇒ Object

Constructs a snapshot event from an incoming webhook after verifying its authenticity. To work with a webhook that has already been verified (i.e. one from a cloud provider, an asynchronous queue, or during testing), see construct_event_without_verification.



11
12
13
14
15
16
17
18
19
20
21
 
# File 'lib/stripe/webhook.rb', line 11

def self.construct_event(payload, sig_header, secret,
                         tolerance: DEFAULT_TOLERANCE)
  Signature.verify_header(payload, sig_header, secret, tolerance: tolerance)

  # It's a good idea to parse the payload only after verifying it. We use
  # `symbolize_names` so it would otherwise be technically possible to
  # flood a target's memory if they were on an older version of Ruby that
  # doesn't GC symbols. It also decreases the likelihood that we receive a
  # bad payload that fails to parse and throws an exception.
  _build_v1_event(payload)
end

.construct_event_without_verification(payload) ⇒ Object

Constructs a snapshot event from an incoming webhook without first verifying its authenticity. Should be used after calling Webhook::Signature.verify_header or with input from a trusted source (such as AWS EventBridge, or Azure Event Grid payload). Or, to verify & construct in a single call, use Webhook.construct_event instead.



29
30
31
 
# File 'lib/stripe/webhook.rb', line 29

def self.construct_event_without_verification(payload)
  _build_v1_event(_maybe_extract_from_cloud_provider_envelope(payload))
end