Stripe Webhook in Bubble - big vulnerability to all apps that use them

Need help APIs
25

FWIW, here’s what I decided to do for now…

  • Obfuscate - I created a randomly generated string for the endpoint (as mentioned by @matt_moo). Sure, it can be seen in the swagger.json file, but at least it’s not obvious that it has anything to do with Stripe.

  • Authenticate - I enabled Bubble authentication on the endpoint.

  • Verify Stripe IP Address - I make sure the source IP address belongs to Stripe - a measure Stripe recommends (in addition to signature verification). There are only a handful, so I just created an Option Set and use a contains operator against the appropriate request header field.

  • Verify Request Is Fresh - I check the signature timestamp and verify that the request was sent within the last 5 minutes.

This is all working fine, and while not bulletproof, I’m certainly not going to lose any sleep wondering if my endpoint is secure.

I might change any of this down the road if I feel it’s warranted.

It’s not obvious to me how one would go about signature verification in Bubble - even with a plugin. Any ideas, @Jici?

4 Likes