Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix stripe event security #26

Closed
riderx opened this issue Jul 4, 2022 · 2 comments
Closed

Fix stripe event security #26

riderx opened this issue Jul 4, 2022 · 2 comments

Comments

@riderx
Copy link
Contributor

riderx commented Jul 4, 2022

The last version of stripe wait to run in deno.
So we have to find a way to validate the signature of event without it

@riderx
Copy link
Contributor Author

riderx commented Jul 8, 2022

I found a way to parse the HMAC signature myself, without the SDK!
With the lib : https://deno.land/x/hmac@v2.0.1
and reading the code in their SDK here:
https://github.com/stripe/stripe-node/blob/master/lib/Webhooks.js
and in python:
https://github.com/stripe/stripe-python/blob/master/stripe/webhook.py

I followed their security protection for time base attack with the code here: https://github.com/freewil/scmp
And the time tolerance for message decoding.

The only issue will be if they change the implementation in the futur.

1 similar comment
@riderx
Copy link
Contributor Author

riderx commented Jul 8, 2022

I found a way to parse the HMAC signature myself, without the SDK!
With the lib : https://deno.land/x/hmac@v2.0.1
and reading the code in their SDK here:
https://github.com/stripe/stripe-node/blob/master/lib/Webhooks.js
and in python:
https://github.com/stripe/stripe-python/blob/master/stripe/webhook.py

I followed their security protection for time base attack with the code here: https://github.com/freewil/scmp
And the time tolerance for message decoding.

The only issue will be if they change the implementation in the futur.

@riderx riderx closed this as completed Jul 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

No branches or pull requests

1 participant