Down the Cloudflare / Stripe / OWASP Rabbit Hole
What I find bleak about the situation, is that it is a glaring design-fail, even though everyone involved should have the necessary expertise to do better. A callback from your payment provider should never go through a best-effort WAF. Instead, as you already have a strong business relationship, you could easily exchange&#x2F;store&#x2F;configure strong credentials with stripe [1]. When even a security professional doesn&#x27;t do that, what does it say about the state of documentation of this feature?<p>Looking at the documentation directly, what they advise you to do is kind of the worst idea they could come up with: <a href="https:&#x2F;&#x2F;stripe.com&#x2F;docs&#x2F;webhooks&#x2F;signatures" rel="nofollow">https:&#x2F;&#x2F;stripe.com&#x2F;docs&#x2F;webhooks&#x2F;signatures</a> – you need custom logic[2] to verify that their MAC (&quot;signature&quot; they call it incorrectly) is valid and you need to configure a <i>different secret</i> for <i>each</i> of your endpoints. And then you still need to handle replay attacks somehow, which is its own nightmare to do correctly. It&#x27;s no wonder the WAF can&#x27;t do that for you.<p>From a few years old personal experience, I&#x27;m really irritated by stripes web-hook approach overall. Payment process information is such a vital business concern that &quot;let&#x27;s try to call them and if that fails... well we tried&quot; is broken on principal alone. The obvious approach is to have an event list which you as customer long-poll or just poll every few seconds if your framework doesn&#x27;t support async well. This is also trivial to do securely: You&#x27;re HTTPS library already authenticates stripe during the TLS handshake and that is all that is necessary.<p>[1] Best case scenario: Let stripe authenticate with mutual TLS, but I know this is quite a long way away from typical web server configurations.<p>[2] Stripe&#x27;s approach very much reminds of DPoP <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31266575" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31266575</a> which shall in now way be construed as a compliment.