-
Notifications
You must be signed in to change notification settings - Fork 460
/
client.go
314 lines (263 loc) · 11 KB
/
client.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
package webhook
import (
"crypto/hmac"
"crypto/sha256"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
"strconv"
"strings"
"time"
"github.com/stripe/stripe-go/v80"
)
//
// Public constants
//
const (
// DefaultTolerance indicates that signatures older than this will be rejected by ConstructEvent.
DefaultTolerance time.Duration = 300 * time.Second
// signingVersion represents the version of the signature we currently use.
signingVersion string = "v1"
)
//
// Public variables
//
// This block represents the list of errors that could be raised when using the webhook package.
var (
ErrInvalidHeader = errors.New("webhook has invalid Stripe-Signature header")
ErrNoValidSignature = errors.New("webhook had no valid signature")
ErrNotSigned = errors.New("webhook has no Stripe-Signature header")
ErrTooOld = errors.New("timestamp wasn't within tolerance")
)
//
// Public functions
//
// ComputeSignature computes a webhook signature using Stripe's v1 signing
// method.
//
// See https://stripe.com/docs/webhooks#signatures for more information.
func ComputeSignature(t time.Time, payload []byte, secret string) []byte {
mac := hmac.New(sha256.New, []byte(secret))
mac.Write([]byte(fmt.Sprintf("%d", t.Unix())))
mac.Write([]byte("."))
mac.Write(payload)
return mac.Sum(nil)
}
// ConstructEvent initializes an Event object from a JSON webhook payload, validating
// the Stripe-Signature header using the specified signing secret. Returns an error
// if the body or Stripe-Signature header provided are unreadable, if the
// signature doesn't match, or if the timestamp for the signature is older than
// DefaultTolerance.
//
// NOTE: Stripe will only send Webhook signing headers after you have retrieved
// your signing secret from the Stripe dashboard:
// https://dashboard.stripe.com/webhooks
//
// This will return an error if the event API version does not match the
// stripe.APIVersion constant.
func ConstructEvent(payload []byte, header string, secret string) (stripe.Event, error) {
return ConstructEventWithTolerance(payload, header, secret, DefaultTolerance)
}
// ConstructEventIgnoringTolerance initializes an Event object from a JSON webhook
// payload, validating the Stripe-Signature header using the specified signing secret.
// Returns an error if the body or Stripe-Signature header provided are unreadable or
// if the signature doesn't match. Does not check the signature's timestamp.
//
// NOTE: Stripe will only send Webhook signing headers after you have retrieved
// your signing secret from the Stripe dashboard:
// https://dashboard.stripe.com/webhooks
//
// This will return an error if the event API version does not match the
// stripe.APIVersion constant.
func ConstructEventIgnoringTolerance(payload []byte, header string, secret string) (stripe.Event, error) {
return constructEvent(payload, header, secret, ConstructEventOptions{IgnoreTolerance: true})
}
// ConstructEventWithTolerance initializes an Event object from a JSON webhook payload,
// validating the signature in the Stripe-Signature header using the specified signing
// secret and tolerance window. Returns an error if the body or Stripe-Signature header
// provided are unreadable, if the signature doesn't match, or if the timestamp
// for the signature is older than the specified tolerance.
//
// NOTE: Stripe will only send Webhook signing headers after you have retrieved
// your signing secret from the Stripe dashboard:
// https://dashboard.stripe.com/webhooks
//
// This will return an error if the event API version does not match the
// stripe.APIVersion constant.
func ConstructEventWithTolerance(payload []byte, header string, secret string, tolerance time.Duration) (stripe.Event, error) {
return constructEvent(payload, header, secret, ConstructEventOptions{Tolerance: tolerance})
}
// ConstructEventWithOptions initializes an Event object from a JSON webhook payload,
// validating the signature in the Stripe-Signature header using the specified signing
// secret and tolerance window provided by the options, if applicable.
//
// See `ConstructEventOptions` for more details on each of the options.
//
// Returns an error if the signature doesn't match, or:
// - if `IgnoreTolerance` is false and the timestamp embedded in the event
// header is not within the tolerance window (similar to `ConstructEventWithTolerance`)
// - if `IgnoreAPIVersionMismatch` is false and the webhook event API version
// does not match the API version of the stripe-go library, as defined in
// `stripe.APIVersion`.
//
// NOTE: Stripe will only send Webhook signing headers after you have retrieved
// your signing secret from the Stripe dashboard:
// https://dashboard.stripe.com/webhooks
func ConstructEventWithOptions(payload []byte, header string, secret string, options ConstructEventOptions) (stripe.Event, error) {
return constructEvent(payload, header, secret, options)
}
// ValidatePayload validates the payload against the Stripe-Signature header
// using the specified signing secret. Returns an error if the body or
// Stripe-Signature header provided are unreadable, if the signature doesn't
// match, or if the timestamp for the signature is older than DefaultTolerance.
//
// NOTE: Stripe will only send Webhook signing headers after you have retrieved
// your signing secret from the Stripe dashboard:
// https://dashboard.stripe.com/webhooks
func ValidatePayload(payload []byte, header string, secret string) error {
return ValidatePayloadWithTolerance(payload, header, secret, DefaultTolerance)
}
// ValidatePayloadIgnoringTolerance validates the payload against the Stripe-Signature header
// using the specified signing secret. Returns an error if the body or
// Stripe-Signature header provided are unreadable or if the signature doesn't match.
// Does not check the signature's timestamp.
//
// NOTE: Stripe will only send Webhook signing headers after you have retrieved
// your signing secret from the Stripe dashboard:
// https://dashboard.stripe.com/webhooks
func ValidatePayloadIgnoringTolerance(payload []byte, header string, secret string) error {
return validatePayload(payload, header, secret, 0*time.Second, false)
}
// ValidatePayloadWithTolerance validates the payload against the Stripe-Signature header
// using the specified signing secret and tolerance window. Returns an error if the body
// or Stripe-Signature header provided are unreadable, if the signature doesn't match, or
// if the timestamp for the signature is older than the specified tolerance.
//
// NOTE: Stripe will only send Webhook signing headers after you have retrieved
// your signing secret from the Stripe dashboard:
// https://dashboard.stripe.com/webhooks
func ValidatePayloadWithTolerance(payload []byte, header string, secret string, tolerance time.Duration) error {
return validatePayload(payload, header, secret, tolerance, true)
}
type ConstructEventOptions struct {
// Validates event timestamps using a custom Tolerance window. If this is
// not set and `IgnoreTolerance` is false, will default to
// `DefaultTolerance`.
Tolerance time.Duration
// If set to true, will ignore the `tolerance` option entirely and will not
// check the event signature's timestamp. Defaults to false. When false,
// constructing an event will fail with an error if the timestamp is not
// within the `Tolerance` window.
IgnoreTolerance bool
// If set to true, will ignore validating whether an event's API version
// matches the stripe-go API version. Defaults to false, returning an error
// when there is a mismatch.
IgnoreAPIVersionMismatch bool
}
//
// Private types
//
type signedHeader struct {
timestamp time.Time
signatures [][]byte
}
//
// Private functions
//
func constructEvent(payload []byte, sigHeader string, secret string, options ConstructEventOptions) (stripe.Event, error) {
e := stripe.Event{}
tolerance := options.Tolerance
if options.Tolerance == 0 && !options.IgnoreTolerance {
tolerance = DefaultTolerance
}
if err := validatePayload(payload, sigHeader, secret, tolerance, !options.IgnoreTolerance); err != nil {
return e, err
}
if err := json.Unmarshal(payload, &e); err != nil {
return e, fmt.Errorf("Failed to parse webhook body json: %s", err.Error())
}
if !options.IgnoreAPIVersionMismatch && e.APIVersion != stripe.APIVersion {
return e, fmt.Errorf("Received event with API version %s, but stripe-go %s expects API version %s. We recommend that you create a WebhookEndpoint with this API version. Otherwise, you can disable this error by using `ConstructEventWithOptions(..., ConstructEventOptions{..., ignoreAPIVersionMismatch: true})` but be wary that objects may be incorrectly deserialized.", e.APIVersion, stripe.ClientVersion, stripe.APIVersion)
}
return e, nil
}
func parseSignatureHeader(header string) (*signedHeader, error) {
sh := &signedHeader{}
if header == "" {
return sh, ErrNotSigned
}
// Signed header looks like "t=1495999758,v1=ABC,v1=DEF,v0=GHI"
pairs := strings.Split(header, ",")
for _, pair := range pairs {
parts := strings.Split(pair, "=")
if len(parts) != 2 {
return sh, ErrInvalidHeader
}
switch parts[0] {
case "t":
timestamp, err := strconv.ParseInt(parts[1], 10, 64)
if err != nil {
return sh, ErrInvalidHeader
}
sh.timestamp = time.Unix(timestamp, 0)
case signingVersion:
sig, err := hex.DecodeString(parts[1])
if err != nil {
continue // Ignore invalid signatures
}
sh.signatures = append(sh.signatures, sig)
default:
continue // Ignore unknown parts of the header
}
}
if len(sh.signatures) == 0 {
return sh, ErrNoValidSignature
}
return sh, nil
}
func validatePayload(payload []byte, sigHeader string, secret string, tolerance time.Duration, enforceTolerance bool) error {
header, err := parseSignatureHeader(sigHeader)
if err != nil {
return err
}
expectedSignature := ComputeSignature(header.timestamp, payload, secret)
expiredTimestamp := time.Since(header.timestamp) > tolerance
if enforceTolerance && expiredTimestamp {
return ErrTooOld
}
// Check all given v1 signatures, multiple signatures will be sent temporarily in the case of a rolled signature secret
for _, sig := range header.signatures {
if hmac.Equal(expectedSignature, sig) {
return nil
}
}
return ErrNoValidSignature
}
// For mocking webhook events
type UnsignedPayload struct {
Payload []byte
Secret string
Timestamp time.Time
Scheme string
}
type SignedPayload struct {
UnsignedPayload
Signature []byte
Header string
}
func GenerateTestSignedPayload(options *UnsignedPayload) *SignedPayload {
signedPayload := &SignedPayload{UnsignedPayload: *options}
if signedPayload.Timestamp == (time.Time{}) {
signedPayload.Timestamp = time.Now()
}
if signedPayload.Scheme == "" {
signedPayload.Scheme = "v1"
}
signedPayload.Signature = ComputeSignature(signedPayload.Timestamp, signedPayload.Payload, signedPayload.Secret)
signedPayload.Header = generateHeader(*signedPayload)
return signedPayload
}
func generateHeader(p SignedPayload) string {
return fmt.Sprintf("t=%d,%s=%s", p.Timestamp.Unix(), p.Scheme, hex.EncodeToString(p.Signature))
}