Class StripeWebhookVerifier

Namespace

NuvTools.Payment.Stripe.ApiClient.Services

Assembly

NuvTools.Payment.Stripe.ApiClient.dll

Checks that a webhook really came from the provider, and reads it.

public class StripeWebhookVerifier : IPaymentWebhookVerifier

Inheritance

object

StripeWebhookVerifier

Implements

IPaymentWebhookVerifier

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

A webhook endpoint is public, so the signature is the whole of its authentication: an unverified body is an anonymous stranger's, and acting on one would let anybody mark a bill paid.

Constructors

StripeWebhookVerifier(IOptions<StripeApiClientConfig>, ILogger<StripeWebhookVerifier>)

Checks that a webhook really came from the provider, and reads it.

public StripeWebhookVerifier(IOptions<StripeApiClientConfig> options, ILogger<StripeWebhookVerifier> logger)

Parameters

options IOptions<StripeApiClientConfig>

logger ILogger<StripeWebhookVerifier>

Remarks

A webhook endpoint is public, so the signature is the whole of its authentication: an unverified body is an anonymous stranger's, and acting on one would let anybody mark a bill paid.

Methods

Verify(string, string?, PaymentWebhookEndpointType)

The event, when the signature matches; a failure when it does not.

public IResult<PaymentEventDTO> Verify(string payload, string? signature, PaymentWebhookEndpointType endpoint = PaymentWebhookEndpointType.Platform)

Parameters

payload string

The request body exactly as received. Re-serializing it — even into an equivalent document — breaks the signature, so it has to be read as a string before anything parses it.

signature string

The signature header the provider sent it with.

endpoint PaymentWebhookEndpointType

Which endpoint it arrived on, for providers that sign each one separately.

Returns

IResult<PaymentEventDTO>