Stripe Webhook Setup Documentation

[godd9170]

How does one configure a webhook within stripe such that it hits the WebhookListener.cls? I've created a new webhook to /services/apexrest/stripe/webhooks/v1 and am only getting INVALID SESSION errors. Am I missing something, or was this built before Salesforce implemented OAuth?

[britishboyindc]

You shouldn't need any authentication.
You setup a Public Site (under Develop - Sites, which I think you have already done) and then in the Public Access Permissions for that site, add your version of the "ExampleWebhookListener.cls" described in the docs to Enabled Apex Class Access section.
This makes that class available to posts to the site without authentication, so that you can then invoke the handle post method to call WebhookListener listener.

[godd9170]

Awesome, thanks @britishboyindc.

Do you know if this introduces any security issues though? Seems kind of dangerous to have anyone able to access the method no?

[britishboyindc]

Yeah, I agree.

When I have implemented Stripe like this, I tend not to "trust" the inbound information. Instead, I extract the EventId from the webhook request sent by Stripe using the Stripe Event class, and then make a callback to Stripe in a separate Salesforce transaction but this time as an authenticated Stripe user with my Stripe Creds and then ask for all the information for that Stripe event Id I just received. Assuming it's valid, I'll get back the JSON response for that event and parse that, knowing it is a valid event for my account.

The other approach I have seen with someone like Twilio is that they send in a signature with the request, which you can then compare using some code in your org - so maybe you could add some metadata tag to the charge when you submit to Stripe, and compare that if you wanted to avoid the need to make a request back to Stripe for the webhook.

[godd9170]

Very clever @britishboyindc, and I appreciate the promptness of your replies.

Thanks again!

[britishboyindc]

Happy to help - planning to push my version up to GIT sometime soon...