better_auth-stripe 0.6.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d60c9b90345ede9ff5fda0bc9420f0f9d2cc415312e0a587daa1e2aa451ec109
-  data.tar.gz: cdd8dfe8742cdc419eb0c94082ad9d5e30b9d6466bc938253cd54267e1e547fc
+  metadata.gz: 1858dc05175fb2101ce2afb5f74a3e7de80a9b88c96a7980fbd7b6bfcac6afcc
+  data.tar.gz: f3f683695cb0f73a2f8d5aca655f9cd8b040fa97e26fadac1300096488cc783f
 SHA512:
-  metadata.gz: ca83e6cbfc4c7ea4dc1f488ac3a91fe842a5fb19cfdd3754d9c334f65b9eb5e8ef1d01ba0c5c350f48a037a06a3e02665906d32f49b60a294878f2657ef0f66b
-  data.tar.gz: 768570c25480a3549a1c85a795cfce82c7a0462ef8c15687619fd682c4aaa4ce9d3193e8490bc6496244ef1d88937a232ca6d3a8136b26223f199018755f02ff
+  metadata.gz: fbb99518f0ad2849d066462f0fa1cbfb0a6451c741eac7aa45d86a6176b03c03543eccd58dc60ecd5df25898c10739d9ce8b033446fc8264822c1754450b4ff1
+  data.tar.gz: f876d15cc9690af96b0b864665a767bd6dddeac4ed8508bede47b78e874a9917e0d032bbc43f77980cc2d27bab89f5f1ea726f60ab97d13cb4ed6734bd170006

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-05-05
+
+- Changed Stripe webhooks to reject requests when the configured Stripe client does not expose `webhooks.construct_event_async` or `webhooks.construct_event`, preventing unverified payload processing.
+- Hardened Stripe subscription route middleware and webhook origin handling with regression coverage.
+
 ## [0.6.0] - 2026-05-02
 
 - Modularized the Stripe plugin into upstream-aligned client, schema, middleware, hooks, route, metadata, type, and utility modules while keeping the existing public facade.

data/lib/better_auth/stripe/middleware.rb

@@ -47,6 +47,22 @@ module BetterAuth
 
         nil
       end
+
+      def validate_trusted_url!(ctx, value, label)
+        return if value.nil? || value.to_s.empty?
+
+        validation_value = value.to_s.gsub("{CHECKOUT_SESSION_ID}", "checkout_session_id")
+        return if ctx.context.trusted_origin?(validation_value, allow_relative_paths: true)
+
+        raise APIError.new("FORBIDDEN", message: "Invalid #{label}")
+      end
+
+      def validate_trusted_urls!(ctx, source, mapping)
+        body = BetterAuth::Plugins.normalize_hash(source || {})
+        mapping.each do |key, label|
+          validate_trusted_url!(ctx, body[key], label)
+        end
+      end
     end
   end
 end

data/lib/better_auth/stripe/routes/cancel_subscription.rb

@@ -10,6 +10,7 @@ module BetterAuth
           BetterAuth::Endpoint.new(path: "/subscription/cancel", method: "POST") do |ctx|
             session = BetterAuth::Routes.current_session(ctx)
             body = BetterAuth::Plugins.normalize_hash(ctx.body)
+            BetterAuth::Stripe::Middleware.validate_trusted_urls!(ctx, body, return_url: "returnUrl")
             customer_type = BetterAuth::Plugins.stripe_customer_type!(body)
             reference_id = BetterAuth::Plugins.stripe_reference_id!(ctx, session, customer_type, body[:reference_id], config)
             BetterAuth::Plugins.stripe_authorize_reference!(ctx, session, reference_id, "cancel-subscription", customer_type, BetterAuth::Plugins.stripe_subscription_options(config), explicit: body.key?(:reference_id))

data/lib/better_auth/stripe/routes/cancel_subscription_callback.rb

@@ -10,6 +10,7 @@ module BetterAuth
           BetterAuth::Endpoint.new(path: "/subscription/cancel/callback", method: "GET") do |ctx|
             query = BetterAuth::Plugins.normalize_hash(ctx.query)
             callback = query[:callback_url] || "/"
+            BetterAuth::Stripe::Middleware.validate_trusted_url!(ctx, callback, "callbackURL")
             unless query[:subscription_id]
               raise ctx.redirect(BetterAuth::Plugins.stripe_url(ctx, callback))
             end

data/lib/better_auth/stripe/routes/create_billing_portal.rb

@@ -10,6 +10,7 @@ module BetterAuth
           BetterAuth::Endpoint.new(path: "/subscription/billing-portal", method: "POST") do |ctx|
             session = BetterAuth::Routes.current_session(ctx)
             body = BetterAuth::Plugins.normalize_hash(ctx.body)
+            BetterAuth::Stripe::Middleware.validate_trusted_urls!(ctx, body, return_url: "returnUrl")
             customer_type = BetterAuth::Plugins.stripe_customer_type!(body)
             reference_id = BetterAuth::Plugins.stripe_reference_id!(ctx, session, customer_type, body[:reference_id], config)
             BetterAuth::Plugins.stripe_authorize_reference!(ctx, session, reference_id, "billing-portal", customer_type, BetterAuth::Plugins.stripe_subscription_options(config), explicit: body.key?(:reference_id))

data/lib/better_auth/stripe/routes/stripe_webhook.rb

@@ -7,23 +7,29 @@ module BetterAuth
         module_function
 
         def endpoint(config)
-          BetterAuth::Endpoint.new(path: "/stripe/webhook", method: "POST") do |ctx|
+          BetterAuth::Endpoint.new(path: "/stripe/webhook", method: "POST", disable_body: true) do |ctx|
             signature = ctx.headers["stripe-signature"]
             raise BetterAuth::APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("STRIPE_SIGNATURE_NOT_FOUND")) if signature.to_s.empty?
 
             raise BetterAuth::APIError.new("INTERNAL_SERVER_ERROR", message: BetterAuth::Stripe::ERROR_CODES.fetch("STRIPE_WEBHOOK_SECRET_NOT_FOUND")) if config[:stripe_webhook_secret].to_s.empty?
 
+            payload = ctx.raw_body.to_s.empty? ? ctx.body : ctx.raw_body
             event = begin
-              if BetterAuth::Plugins.stripe_client(config).respond_to?(:webhooks)
-                webhooks = BetterAuth::Plugins.stripe_client(config).webhooks
-                if webhooks.respond_to?(:construct_event_async)
-                  webhooks.construct_event_async(ctx.body, signature, config[:stripe_webhook_secret])
-                else
-                  webhooks.construct_event(ctx.body, signature, config[:stripe_webhook_secret])
-                end
+              client = BetterAuth::Plugins.stripe_client(config)
+              webhooks = client.webhooks if client.respond_to?(:webhooks)
+              unless webhooks
+                raise BetterAuth::APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("FAILED_TO_CONSTRUCT_STRIPE_EVENT"))
+              end
+
+              if webhooks.respond_to?(:construct_event_async)
+                webhooks.construct_event_async(payload, signature, config[:stripe_webhook_secret])
+              elsif webhooks.respond_to?(:construct_event)
+                webhooks.construct_event(payload, signature, config[:stripe_webhook_secret])
               else
-                ctx.body
+                raise BetterAuth::APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("FAILED_TO_CONSTRUCT_STRIPE_EVENT"))
               end
+            rescue BetterAuth::APIError
+              raise
             rescue
               raise BetterAuth::APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("FAILED_TO_CONSTRUCT_STRIPE_EVENT"))
             end

data/lib/better_auth/stripe/routes/subscription_success.rb

@@ -10,6 +10,7 @@ module BetterAuth
           BetterAuth::Endpoint.new(path: "/subscription/success", method: "GET") do |ctx|
             query = BetterAuth::Plugins.normalize_hash(ctx.query)
             callback = query[:callback_url] || "/"
+            BetterAuth::Stripe::Middleware.validate_trusted_url!(ctx, callback, "callbackURL")
             checkout_session_id = query[:checkout_session_id]
             subscription_id = query[:subscription_id]
             if checkout_session_id

data/lib/better_auth/stripe/routes/upgrade_subscription.rb

@@ -10,6 +10,7 @@ module BetterAuth
           BetterAuth::Endpoint.new(path: "/subscription/upgrade", method: "POST") do |ctx|
             session = BetterAuth::Routes.current_session(ctx)
             body = BetterAuth::Plugins.normalize_hash(ctx.body)
+            BetterAuth::Stripe::Middleware.validate_trusted_urls!(ctx, body, success_url: "successUrl", cancel_url: "cancelUrl", return_url: "returnUrl")
             subscription_options = BetterAuth::Plugins.stripe_subscription_options(config)
             customer_type = BetterAuth::Plugins.stripe_customer_type!(body)
             reference_id = BetterAuth::Plugins.stripe_reference_id!(ctx, session, customer_type, body[:reference_id], config)

data/lib/better_auth/stripe/version.rb

@@ -2,6 +2,6 @@
 
 module BetterAuth
   module Stripe
-    VERSION = "0.6.2"
+    VERSION = "0.7.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: better_auth-stripe
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Sebastian Sala