stripe_event 1.9.0 → 1.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 154ef1f07846c2b1a26499b02ed2119c3057636737d61ba6b9bcb234bc897782
-  data.tar.gz: ac4ea8924d5b8c037115131ae9d8e71f1f78a3dbd42da45b916e2584a76f4cdd
+  metadata.gz: 3f827c24a3682b3e707e6f9547bf4237ddda2ffa07341bed8207e6090372abd0
+  data.tar.gz: cb1aa0db4c845265921b5755a8f49aa3701447d113ed2139b77b1273eef5d3f1
 SHA512:
-  metadata.gz: aaff93b989d0ecbf55748c01f029f824802b323966bf2ce78e1dc2b7b607a88585bf76ff45b36eb309a3d00f261cc8c7f36643633d4b58e81332ccb0db9de5b2
-  data.tar.gz: 2afffbfd031029657a1ba839d6dd56c4c809d2e7ba639db27ef5a9c320a533011c93d8163dbe6c353e57db6b3219dc78716c8fc892b89ec04ed1acb6f6ef997f
+  metadata.gz: ed4f46f5d8ce37d6dd55fd91e183b2327f0cd06c3048bff9c900124335745cb95895eb0fa6c7f409db6b46f1f275055a54ab4cf07e8451c42900535c50e4a5cd
+  data.tar.gz: 8e20e3249afa9b7320df0abbcac2584788d2904b51030c6b21768cbe2def63a7d43d0bb445de1b5520fc63b7493ee0afa0efde13f372dc7036f48d91edba7fb7

data/CHANGELOG.md

@@ -1,6 +1,17 @@
+### 1.9.1 (November 30, 2017)
+
+This release is in preparation for some backward incompatible changes due to
+arrive in v2.0.0.  It is highly recommended that everyone secure their webhook
+endpoints by using `StripeEvent.signing_secret`. See the README and [Stripe's
+documentation](https://stripe.com/docs/webhooks#signatures) for more
+information.
+
+  * Deprecate `StripeEvent.authentication_secret` (#96)
+  * Deprecate unverified use of Stripe webhook's (#96)
+
 ### 1.9.0 (November 30, 2017)
 
-  * Support for Rails 5.1 (#94, Thanks @krasnoukhov and @simplepractice!
+  * Support for Rails 5.1 (#94, Thanks @krasnoukhov and @simplepractice!)
 
 ### 1.8.0 (August 29, 2017)
 

data/README.md

@@ -25,7 +25,8 @@ mount StripeEvent::Engine, at: '/my-chosen-path' # provide a custom path
 
 ```ruby
 # config/initializers/stripe.rb
-Stripe.api_key = ENV['STRIPE_SECRET_KEY'] # e.g. sk_live_1234
+Stripe.api_key             = ENV['STRIPE_SECRET_KEY']     # e.g. sk_live_...
+StripeEvent.signing_secret = ENV['STRIPE_SIGNING_SECRET'] # e.g. whsec_...
 
 StripeEvent.configure do |events|
   events.subscribe 'charge.failed' do |event|
@@ -78,6 +79,18 @@ end
 
 ## Securing your webhook endpoint
 
+### Authenticating webhooks with signatures (recommended)
+
+Stripe will cryptographically sign webhook payloads with a signature that is included in a special header sent with the request. Verifying this signature lets your application properly authenticate the request originated from Stripe. To leverage this feature, please set the `signing_secret` configuration value:
+
+```
+StripeEvent.signing_secret = Rails.application.secrets.stripe_signing_secret
+```
+
+Please refer to Stripe's documentation for more details: https://stripe.com/docs/webhooks#signatures
+
+### Basic authentication (DEPRECATED)
+
 StripeEvent automatically fetches events from Stripe to ensure they haven't been forged. However, that doesn't prevent an attacker who knows your endpoint name and an event's ID from forcing your server to process a legitimate event twice. If that event triggers some useful action, like generating a license key or enabling a delinquent account, you could end up giving something the attacker is supposed to pay for away for free.
 
 To prevent this, StripeEvent supports using HTTP Basic authentication on your webhook endpoint. If only Stripe knows the basic authentication password, this ensures that the request really comes from Stripe. Here's what you do:
@@ -99,16 +112,6 @@ To prevent this, StripeEvent supports using HTTP Basic authentication on your we
 
 This is only truly secure if your webhook endpoint is accessed over SSL, which Stripe strongly recommends anyway.
 
-## Authenticating webhooks
-
-Stripe will cryptographically sign webhook payloads with a signature that is included in a special header sent with the request. Verifying this signature lets your application properly authenticate the request originated from Stripe. To leverage this feature, please set the `signing_secret` configuration value:
-
-```
-StripeEvent.signing_secret = Rails.application.secrets.stripe_signing_secret
-```
-
-Please refer to Stripe's documentation for more details: https://stripe.com/docs/webhooks#signatures
-
 ## Configuration
 
 If you have built an application that has multiple Stripe accounts--say, each of your customers has their own--you may want to define your own way of retrieving events from Stripe (e.g. perhaps you want to use the [account parameter](https://stripe.com/docs/connect/webhooks) from the top level to detect the customer for the event, then grab their specific API key). You can do this:

data/app/controllers/stripe_event/webhook_controller.rb

@@ -37,6 +37,13 @@ module StripeEvent
         signature = request.headers['Stripe-Signature']
 
         Stripe::Webhook::Signature.verify_header payload, signature, StripeEvent.signing_secret
+      else
+        ActiveSupport::Deprecation.warn(
+        "[STRIPE_EVENT] Unverified use of stripe webhooks is deprecated and configuration of " +
+        "`StripeEvent.signing_secret=` will be required in 2.x. The value for your specific " +
+        "endpoint's signing secret (starting with `whsec_`) is in your API > Webhooks settings " +
+        "(https://dashboard.stripe.com/account/webhooks). " +
+        "More information can be found here: https://stripe.com/docs/webhooks#signatures")
       end
     rescue Stripe::SignatureVerificationError
       head :bad_request

data/lib/stripe_event.rb

@@ -44,6 +44,16 @@ module StripeEvent
       namespaced_name = namespace.call(name)
       backend.notifier.listening?(namespaced_name)
     end
+
+    def authentication_secret=(value)
+      ActiveSupport::Deprecation.warn(
+        "[STRIPE_EVENT] `StripeEvent.authentication_secret=` is deprecated and will be " +
+        "removed in 2.x. Use `StripeEvent.signing_secret=` instead. The value " +
+        "for your specific endpoint's signing secret (starting with `whsec_`) is in your " +
+        "API > Webhooks settings (https://dashboard.stripe.com/account/webhooks). " +
+        "More information can be found here: https://stripe.com/docs/webhooks#signatures")
+      @authentication_secret = value
+    end
   end
 
   class Namespace < Struct.new(:value, :delimiter)

data/lib/stripe_event/version.rb

@@ -1,3 +1,3 @@
 module StripeEvent
-  VERSION = "1.9.0"
+  VERSION = "1.9.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stripe_event
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.9.1
 platform: ruby
 authors:
 - Danny Whalen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-30 00:00:00.000000000 Z
+date: 2017-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport