New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stripe event handling doesn't verify the source #1765

Open

alexgmin opened this issue Nov 23, 2024 · 0 comments

Contributor

alexgmin commented Nov 23, 2024

djangoproject.com/fundraising/views.py

Lines 196 to 201 in 5537f96

    
           # For security, re-request the event object from Stripe. 
        
           # TODO: Verify shared secret here? 
        
           try: 
        
               event = stripe.Event.retrieve(data["id"]) 
        
           except stripe.error.InvalidRequestError: 
        
               return HttpResponse(422)

Instead of calling Stripe with the event id it should verify the source of the event and prevent replay attacks as indicated here
https://docs.stripe.com/webhooks#verify-events

The Stripe library already has a method to do this https://docs.stripe.com/webhooks?lang=python#verify-webhook-signatures-with-official-libraries

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment