stripekit::DefaultWebhookSignatureVerifier Class Reference

The signature verifier StripeKit uses by default. More...

#include <WebhookVerifier.h>

Inheritance diagram for stripekit::DefaultWebhookSignatureVerifier:

Public Member Functions
VerificationMetadata	verify (const WebhookVerificationInput &input) const override
	Checks a signature and reports what it contained.
Public Member Functions inherited from stripekit::WebhookSignatureVerifier
virtual	~WebhookSignatureVerifier ()=default
	Destroys the verifier instance.

Static Public Member Functions
static bool	is_available ()
	Reports whether this build can verify signatures.

Detailed Description

The signature verifier StripeKit uses by default.

Implements Stripe's scheme: HMAC-SHA256 over the timestamp and payload, compared in constant time so the comparison itself leaks nothing.

See also

https://docs.stripe.com/webhooks#verify-events

Definition at line 94 of file WebhookVerifier.h.

Member Function Documentation

verify()

VerificationMetadata stripekit::DefaultWebhookSignatureVerifier::verify ( const WebhookVerificationInput & input ) const

overridevirtual

Checks a signature and reports what it contained.

Parameters

input

The payload, signature header, secret, and timing rules.

Returns

The timestamp and signed string from the verified signature.

Exceptions

SignatureVerificationException	The header is malformed, no signature matches, or the timestamp is outside the tolerance.
ConfigurationException	This build has no cryptography support.

Implements stripekit::WebhookSignatureVerifier.

is_available()

bool stripekit::DefaultWebhookSignatureVerifier::is_available ( )

static

Reports whether this build can verify signatures.

Verification needs libsodium, which is a build option. Without it, webhooks cannot be trusted and must not be accepted.

Returns

True when signature verification is available.

---

The documentation for this class was generated from the following file:

• src/core/include/StripeKit/WebhookVerifier.h