Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save alexpgates/4827ff68102486ea21af3b1c28c27c57 to your computer and use it in GitHub Desktop.
Save alexpgates/4827ff68102486ea21af3b1c28c27c57 to your computer and use it in GitHub Desktop.
I use this method on a StripeWebhook model. Based on the guide here: https://stripe.com/docs/webhooks#verify-manually
public function isValid(\Illuminate\Http\Request $request){
// Grab the Stripe-Signature header
$header_signature = $request->header('Stripe-Signature');
// sets variables $t and $v1 with their values, (and any other elements that stripe may pass along that we'll ignore)
foreach(explode(',', $header_signature) as $key => $val){
$prefix = str_before($val, '=');
$$prefix = str_after($val, '=');
}
// Prepare the signed_payload string
$signed_payload = $t.'.'.$request->getContent();
// Determine the expected signature
// webook_secret obtained on the webhooks settings screen in stripe account
$expected_signature = hash_hmac('sha256', $signed_payload, config('services.stripe.webhook_secret'));
if($expected_signature == $v1){
// Good to go!
return true;
}
Log::warning('Webhook request determined to be invalid: '.print_r($request->all(), true));
return false;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment