Deploy script with no signature
Software and Data Integrity Failures

The attacker finds your Stripe webhook URL in a network tab or a leaked .env. The handler is live.

1. 1
   Read the docs

   They look up the exact JSON shape of a Stripe 'checkout.session.completed' event in the public documentation.
2. 2
   Forge a payload

   They build a fake event with an order ID from your public order flow and the amount set to whatever they want.
3. 3
   POST it cold

   They send the fake event directly to your webhook endpoint. No signature header, no Stripe involvement — just a raw POST.
4. 4
   Free orders forever

   Your handler parses the JSON, marks the order paid, and ships the product. The real Stripe dashboard shows nothing because the real Stripe never saw the request.

The attacker places unlimited orders at zero cost until someone manually reconciles the ledger. By then the inventory is gone.

// app/api/webhooks/stripe/route.ts
export async function POST(req) {
  const event = await req.json();

  if (event.type === 'checkout.session.completed') {
    await db.order.update({
      where: { id: event.data.object.metadata.orderId },
      data: { status: 'paid' },
    });
  }

  return Response.json({ received: true });
}

// app/api/webhooks/stripe/route.ts
import Stripe from 'stripe';

const stripe = new Stripe(process.env.STRIPE_SECRET!);

export async function POST(req) {
  const body = await req.text();
  const sig = req.headers.get('stripe-signature')!;

  let event;
  try {
    event = stripe.webhooks.constructEvent(
      body,
      sig,
      process.env.STRIPE_WEBHOOK_SECRET!,
    );
  } catch {
    return Response.json({ error: 'Bad signature' }, { status: 400 });
  }

  if (event.type === 'checkout.session.completed') {
    await db.order.update({
      where: { id: event.data.object.metadata.orderId },
      data: { status: 'paid' },
    });
  }

  return Response.json({ received: true });
}

The fix is one call — constructEvent — that verifies the signature against the shared secret before the handler trusts anything. If the signature is missing or wrong, the request dies at the door.