Stripe webhook integration

[i-h8-github]

Hello,

I cannot for the life of me get Stripe webhook working in roda. It seems the app just rejects the POST request outright, because nothing inside the route block gets run, and puma just returns an immediate 400. I felt like this is a csp thing, but after commenting out the content_security_policy and route_csrf plugins, nothing has changed. I'm at my wits' end trying to figure out the reason behind this behavior. Any ideas?

The most annoying thing about this is that I can see the requests in puma's output, but it just looks like:

"POST /webhook HTTP/1.1" 400 10613 0.0002

and nothing inside r.post gets run at all, including a puts statement at the top that's there for a sanity check and confirmed working for other routes I've defined within the app. So does that mean puma is seeing the request, but roda isn't?

Thank you for your time.

[jeremyevans]

content_security_policy only provides a header used by browsers. route_csrf has no effect unless you are calling check_csrf! somewhere in your routing tree. Are you possibly using the older csrf plugin, which uses the rack-csrf middleware and could return 400 before the route block is executed?

[i-h8-github]

Thank you for your reply.

I am not using csrf plugin, but now when I comment out check_csrf! at the top of route do (I would have thought commenting out plugin :route_csrf would have triggered errors for check_csrf! or something, but thank you kindly for making me realize that was the blocking line) , my puts in both post and webhook blocks run, but I get status 500. So progress, I guess.

[i-h8-github]

Now that I've had a chance to rest my brain, I've got something working. However, I do still wonder what the best practice is for keeping csrf and having an exception for this case.