Always get "The signature for the webhook is not present in the Stripe-Signature header"

[xqiu]

I'm using the test stripe to finish a checkout via webhook

The webook sends the following information to me
json:

{
  "id": "evt_1Fp8QCHONLOCX93ZtvM6ZfBJ",
  "object": "event",
  "api_version": "2019-11-05",
  "created": 1576221524,
  "data": {
    "object": {
      "id": "cs_test_sIivnmE97W8f01Gd9sKZWcHq0d4dtZorGKxo5rCRPn6qrRtkzd5Lu2Ux",
      "object": "checkout.session",
      "billing_address_collection": null,
      "cancel_url": "https://yushuhometest.azurewebsites.net/stripesuccess",
      "client_reference_id": null,
      "customer": "cus_GLq6B0RztXkLmK",
      "customer_email": "falu@puti.org",
      "display_items": [
        {
          "amount": 360000,
          "currency": "usd",
          "custom": {
            "description": "Annual Individual Sponsor VIP",
            "images": null,
            "name": "Annual Individual Sponsor VIP"
          },
          "quantity": 1,
          "type": "custom"
        }
      ],
      "livemode": false,
      "locale": "en",
      "mode": "payment",
      "payment_intent": "pi_1Fp8Q0HONLOCX93ZB2PHU7ZE",
      "payment_method_types": [
        "card"
      ],
      "setup_intent": null,
      "submit_type": null,
      "subscription": null,
      "success_url": "https://yushuhometest.azurewebsites.net/stripesuccess"
    }
  },
  "livemode": false,
  "pending_webhooks": 2,
  "request": {
    "id": null,
    "idempotency_key": null
  },
  "type": "checkout.session.completed"
}

stripe signature:

["t=1576221525,v1=da12e2b3870f0a97f8c9c22cc33991d716f0a1f9b1a5525fc9e2156cf14c901b,v0=88237c4455f8b2ab2bda2d90f88d215c7969bd10812a677d118ec3af662c2886"]

Stripe Webhook EndpointSecret I used for current test account:

whsec_ENfRxeb90Em1jhIAPccT48Adjt7J5Y0l

But I still get Stripe exception: "The signature for the webhook is not present in the Stripe-Signature header."

I used asp.net core 2.2 to write the following code:

        [HttpPost("[action]")]
        public async Task<IActionResult> Hook()
        {
            string json = await new StreamReader(HttpContext.Request.Body).ReadToEndAsync();
           Stripe.Event stripeEvent = stripeEvent = Stripe.EventUtility.ConstructEvent(json, Request.Headers["Stripe-Signature"], _stripeConfig.WebhookEndpointSecret);
        ...
       }

I wonder what's wrong with the code? I even went as far as debugging the signature comparing code in stripe.net , still don't see the issue. I failed in both dev machine (using CLI with its own secret), and in the cloud test server (using secret get from webhook).

Thanks!

[ob-stripe]

Hi @xqiu. Your code looks correct, and I've manually recomputed the signature to double-check that it's the correct one for that payload.

I would recommend checking the following:

• make sure that _stripeConfig.WebhookEndpointSecret contains the "whsec_..." secret as a string, with no whitespace or newline characters
• make sure that Request.Headers["Stripe-Signature"] contains the "t=...,v1=...,v0=..." header value, with no whitespace or newline characters
• make sure that json contains the JSON payload of the event, with no trailing newline character after the last } character

[xqiu]

Thanks, ensuring triming the strings making my code work.

            string jsonOri = await new StreamReader(Request.Body).ReadToEndAsync();
            string json = jsonOri.Trim(new char[] { ' ', '\n', '\r' });
            string header = Request.Headers["Stripe-Signature"];
            string signature = header.Trim(new char[] { ' ', '\n', '\r' });
            try
            {
                Stripe.Event stripeEvent = Stripe.EventUtility.ConstructEvent(json, signature, _stripeConfig.WebhookEndpointSecret, 300, false);

[r3plica]

I tried that and I still get the error and I can verify that it does have all the steps you mentioned (endpoint secret starts with "whsec_", the header has t=, v1, v1 in it with no spaces, etc and the json string ends with \"payment_intent.created\"\n}")

[xqiu]

I tried that and I still get the error and I can verify that it does have all the steps you mentioned (endpoint secret starts with "whsec_", the header has t=, v1, v1 in it with no spaces, etc and the json string ends with \"payment_intent.created\"\n}")

Did you try the code I show above with triming both json and header? It works for me.

[r3plica]

I actually figured this out; I was using the secret from the dashboard, but stripe cli gives you a temporary one. There was no need to do any of the triming

[HoxWi]

This problem is unbelievable, well done @xqiu !

[ghost]

I am using stripe direct checkout for payment and configured webhook, getting "The signature for the webhook is not present in the Stripe-Signature header." error in the below code.

string jsonOri = await new StreamReader(Request.Body).ReadToEndAsync();
string json = jsonOri.Trim(new char[] { ' ', '\n', '\r' });
string header = Request.Headers["Stripe-Signature"];
string signature = header.Trim(new char[] { ' ', '\n', '\r' });

            if (Request.Headers["Stripe-Signature"].Count() > 0)
            {
                // validate webhook called by stripe only
            Stripe.Event stripeEvent  = Stripe.EventUtility.ConstructEvent(json,signature,"whsec_QpG30JY8XXXXXXXXX",300,false);

I also upgraded the API version to the latest 2020-08-27.

@xqiu Please look into this.

[remi-stripe]

@sonam2020 Please contact our support team for help instead: https://support.stripe.com/contact

[k0kishima]

I wanted to share an experience I encountered, which might be helpful for others facing similar the issue.

In my case, the issue was found to be related to the AWS CloudFront configuration. It appears that CloudFront was stripping off certain headers, including stripe-signature, before they reached our webhook endpoint.

After diving into the CloudFront settings, we adjusted our configuration to explicitly include the stripe-signature header in the list of headers forwarded to the origin.

[miguelmobilat]

I wanted to share an experience I encountered, which might be helpful for others facing similar the issue.

In my case, the issue was found to be related to the AWS CloudFront configuration. It appears that CloudFront was stripping off certain headers, including stripe-signature, before they reached our webhook endpoint.

After diving into the CloudFront settings, we adjusted our configuration to explicitly include the stripe-signature header in the list of headers forwarded to the origin.

How did you solve it on the cloudfront?

[k0kishima]

How did you solve it on the cloudfront?

I did it like this.

Sorry, I only had a screenshot of the Japanese UI.