#324

Stripe: webhook bodies are not Event objects (no `id`, `object`, `created`, `api_version`, `livemode`)

Openjcardonneopened 21d ago

Problem

Stripe webhook deliveries are signed correctly (Stripe-Signature), but the body is only { type, data: { object } }. For example, checkout-sessions.ts dispatches { type: "checkout.session.completed", data: { object: formatSession(...) } }.

A real delivery is an Event object (https://docs.stripe.com/api/events/object): id (evt_...), object: "event", created, api_version, livemode, pending_webhooks, request, type, data.object (and data.previous_attributes on updates).

Receivers deduplicate on event.id (Stripe documents duplicates and asks receivers to guard against them: https://docs.stripe.com/webhooks#handle-duplicate-events) and order on created. A receiver that refuses id-less events acknowledges every emulated delivery and applies none of them, so checkout-to-fulfilment flows cannot be tested end to end.

Reproduced on published emulate 0.12.2. The code is unchanged on main at 4c0422e.

Reproduction

  1. Seed a price and a webhook (events: [checkout.session.completed], with a secret).
  2. Create a Checkout Session and complete it (POST /checkout/:id/complete).
  3. Inspect the delivered body.

Actual: {"type":"checkout.session.completed","data":{"object":{...}}}.

Expected: an Event envelope with a unique evt_ id per event (the same id on a redelivery), object: "event", created in Unix seconds, api_version and livemode: false, with GET /v1/events/:id returning it as a bonus.

Activity

0

No activity yet.