I wasn’t able to find any useful help for validating webhooks from stripe, and I’m posting this here in case it helps anyone. Stripe has instructions, but the difficulty was that you need to get stripe’s JSON in the same form that they made the signature with. In other words you need the raw request data before it gets parsed into a JSON object by your router. There are a few tips out there suggesting you can compose the raw request data using code such as:
this.request.on('data', function (chunk) {
rawBody += chunk;
});
However, it didn’t work in my routes. I am using iron router, and needed to add it in the onBeforeAction hook where you actually have access to the raw request data. The working code is like this:
Router.onBeforeAction(function(req,res,next) {
var rawBody = "";
req.on('data', function (chunk) {
rawBody += chunk;
req.rawBody = rawBody;
});
req.on('end', function () {
req.rawBody = rawBody;
});
next();
}, { only: 'myStripeWebhookRouteName' });
Then in your “myStripeWebhookRouteName” route you can access the data in the rawBody field you just created as this.connection.rawBody. Then you can continue with stripe’s instructions, either using their webhook validator in the 5.0.+ version node package or it’s easy enough to do it yourself with cryptoJS HmacSha256 function (you’d need meteor packages jparker:crypto-sha256 and jparker:crypto-hmac).
Also, stripe’s JSON is formatted like JSON.stringify(obj,null,2), so you could probably just reconstruct the JSON string from the JSON object and not go through all these shenanigans, but I haven’t tested that.