search

integrallis / stripe_event

Stripe webhook integration for Rails applications.
https://rubygems.org/gems/stripe_event
MIT License
840 stars 107 forks source link

Webhook Signatures Can't be Verified if Some of the `signing_secrets` are nil #145

Closed vakrolme closed 2 years ago

vakrolme commented 2 years ago

I set up your initializer like this:

StripeEvent.signing_secrets = [
  ENV['STRIPE_SIGNING_SECRET_DEV_GB'],
  ENV['STRIPE_SIGNING_SECRET_PROD_GB'],
  ENV['STRIPE_SIGNING_SECRET_DEV_US'],
  ENV['STRIPE_SIGNING_SECRET_PROD_US'],
  ENV['STRIPE_SIGNING_SECRET_LOCAL']
]

Depending on the particular environment, some of those vars are nil, because they are only set in another environment.

If a webhook comes along with a signature that is present in the array above, but it's preceded by one that is not set, you get the following error:

Cannot verify signature without a StripeEvent.signing_secret

Putting .compact after the array solves the issue.