419 Error When Testing Stripe Webhook
Hi there,
The secret keys should remain the same but the signing secret (STRIPE_WEBHOOK_SECRET ) would be a new one which you will have to add to your .env file and then clear your config:
php artisan optimize:clear
Also, does your APP_URL match https://wave.test?
Hi yes, I meant that I am changing the STRIPE WEBHOOK SECRET to what is returned in the terminal upon starting. I tried then running the optimize:clear command after and I am getting the same result. I am using my actual test domain in my real setup, not wave.test. The responses seem to be hitting the webhook script but the 419 error indicates maybe a CSRF or page expired type or response. I'm not sure how that's happening. Is there anything else I should check?
Hey!
The /webhook/stripe route is already excluded from the CSRF protection:
Have you by any chance made any changes to that file?
Also the APP URL needs to match the domain that you've used to start the stripe listen --forward-to command, otherwise a redirect might occur which could also cause that error.
Alright, I once again isolated the problem to the bootstrap/app.php config file I had made changes to in order to include a health check endpoint. I guess the Excpetions in the middleware isn't registering with the changes I made. Here is my 'updated' file (this code below breaks the Stripe CSRF exclusion middleware):
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
return Application::configure(basePath: dirname(__DIR__))
->withRouting(
web: __DIR__.'/../routes/web.php',
api: __DIR__.'/../routes/api.php',
commands: __DIR__.'/../routes/console.php',
channels: __DIR__.'/../routes/channels.php',
health: '/up',
)
->withMiddleware(function (Middleware $middleware) {
$middleware->statefulApi();
})
->withExceptions(function (Exceptions $exceptions) {
//
})->create();
It seems that the current version of this file is an outdated method. Is there a chance we can modernize this file and get an updated version that has the health endpoint but also still works with Wave?
Oh, you might need to exclude the route in the bootstrap/app.php file as I remember that you added a custom one in one of our previous discussions.
Follow the steps here:
->withMiddleware(function (Middleware $middleware) {
$middleware->validateCsrfTokens(except: [
'webhook/*',
'http://example.com/foo/bar',
'http://example.com/foo/*',
]);
})
Awesome! Happy to hear that it worked!