Freeform / Stripe Webhook showing 500 and 404 errors

[ndsurgenor]

What happened?

Using a form in Craft which is integrated with Stripe to process one-off payments. Data is being submitted OK and received in form submissions/email notifications but the webhooks for development and live site as displaying errors for the invoice.payment_succeeded and customer.subscription.created events

DEV WEBHOOK

Connection denied (500 error shown using stripe CLI)

LIVE WEBHOOK

404 Error

I've checked and double-checked the variables and url endpoints and they are all correct. As I said, the payment is being accepted when using test cards on the dev and through testing on live but these events are showing errors and, as stripe keeps retrying, it's eventually causing the webhook to disable.

I've chatted plenty with ChatGPT and its suggestion at this point is to start making changes to the vendor code which I'm not going to do!

Errors and Stack Trace (if available)

No response

How can we reproduce this?

1. Send up Form in Craft
2. Integrate with Stripe
3. Submit form then inspect webhooks on Stripe

Freeform Edition

Pro

Freeform Version

5.1.12

Craft Version

Pro 4.8.6

When did this issue start?

Unsure

Previous Freeform Version

No response

[gustavs-gutmanis]

Hi @ndsurgenor,

Sorry to hear you're experiencing issues.

Could you share a screenshot of your Stripe configuration inside the Settings > Payments page for both Live and Dev sites? (With sensitive data blurred out, of course)

From reading the ticket, first thing that comes to mind is a misconfiguration issue.

For dev:

When you want to test events on a dev environment, you're most likely working on a local hosted server on your computer, and that address is not accessible from outside. To test events locally you would need to use the Stripe CLI and forward webhook events to your dev url.

To listen to successful payments, you would do:

$ stripe listen --forward-to https://your-local-url.test/freeform/payments/stripe/webhook --skip-verify --events=payment_intent.succeeded

Then, when making successful payments locally in your dev environment - you would receive proper webhook triggers.

For prod:

To have webhooks working properly in prod, you need to make sure you create a new Webhook in your Stripe Dashboard.

Specify the URL that is displayed in your Stripe integration page for "Webhook URL",

Once that is created, you need to get the signing secret by clicking the "Reveal"

And then copy & paste the signing secret in your "Webhook Secret" input.

Without the signing secret, Freeform will discard the event.

From the 404 error that your live site is displaying, it looks like the URL cannot be found by stripe. Is the webhook url used in Live publicly accessible?

[ndsurgenor]

Hi there, thanks for getting back to me!

Screenshot of live site settings from inside craft Freeform

I note in your screenshot of the webhook that there are payment_intent triggers present which I do not have as the documentation mentioned otherwise; could this be the problem?

[gustavs-gutmanis]

@ndsurgenor I noticed that the documentation does not reflect the latest changes in Freeform 5 that we introduced, and I'm very sorry for that. Could you add the payment intent events, and remove the other ones, please?

We will adjust the documentation and inline examples in Freeform. Sorry again.

[ndsurgenor]

No worries! I'll give it a go now and see how it goes :)

[gustavs-gutmanis]

Please let me know if that solves it. I have a feeling that it might not, since the 404 error indicates that Stripe cannot reach the endpoint, which is weird. It worked in my tests. Are you able to access the webhook url via your browser?

[ndsurgenor]

Hi again. Updated those webhooks and used the $ stripe listen --forward-to https://your-local-url.test/freeform/payments/stripe/webhook --skip-verify --events=payment_intent.succeeded and testing setting on my dev site. In the terminal for dev site I can see the following:

> Ready! You are using Stripe API Version [2024-06-20]. Your webhook signing secret is [REDACTED] (^C to quit)
2024-10-17 13:36:56   --> payment_intent.succeeded [evt_3QAswVJkBfbOCys70VfTmq25]
2024-10-17 13:36:57  <--  [401] POST https://[REDACTED].ddev.site/freeform/payments/stripe/webhook [evt_3QAswVJkBfbOCys70VfTmq25]

Still getting same error of "Connection to remote host denied (please contact support at https://support.stripe.com/contact/)" on the dev webhook and 404 (not found) on the live one.

Putting the webhook URL into a browser gives a 404 page. Screenshot below from live site:

[gustavs-gutmanis]

Hi @ndsurgenor,

Dev URL

The 401 error happens when the signing secret is invalid. Did you copy the signing secret from the terminal into the stripe integration "Webhook Secret" field? Each time you run stripe listen a new secret is generated for the duration of the process, and you need to copy it into the stripe integration.

Also just to make sure - did you change the https://your-local-url.test to your local domain? I used your-local-url.test as an example, you have to change it to your local url.

Public URL

As for the 404 error which you get on the public site - that is fine, since the payment_intent that is coming from a webhook will contain hashed data about the form, integration and submission used in the integration. If you just open the page in your browser, it won't have it and will throw a 404, but that tells us that the endpoint is working as expected, instead of it being inaccessible. So your public site webhook should work fine, assuming that the signing secret and webhook destination URL's are configured properly.

[ndsurgenor]

As for the 404 error which you get on the public site - that is fine, since the payment_intent that is coming from a webhook will contain hashed data about the form, integration and submission used in the integration. If you just open the page in your browser, it won't have it and will throw a 404, but that tells us that the endpoint is working as expected, instead of it being inaccessible. So your public site webhook should work fine, assuming that the signing secret and webhook destination URL's are configured properly.

Yes, when I try that URL in my browser it shows the custom 404 page for that site.

So you are saying not to worry about Stripe continuing to show a 404 error for the payment_intent.succeeded event? The reason I have some concern is that when trying it before, Stripe automatically disabled the webhook due to so many failed attempts. Is there a way to tell Stripe to ignore the 404 and treat it as a 200?

[gustavs-gutmanis]

With the change in events that have to be selected for the webhook, 404 errors should no longer be happening.

[ndsurgenor]

So if Stripe is continuing to send and retry them as per the screenshot below this won't be an issue or I should try setting it up again to prevent this error?

[gustavs-gutmanis]

No this should not be happening. Is this happening with the live version and an actual stripe submission?

[gustavs-gutmanis]

Could you please create a support ticket so we can see how we can help you out with this issue?