Skip to content

Ability to bypass signature verification - #137

Open
luis-ca wants to merge 5 commits into
integrallis:masterfrom
fullfabric:ability_to_bypass_signature_verification
Open

Ability to bypass signature verification#137
luis-ca wants to merge 5 commits into
integrallis:masterfrom
fullfabric:ability_to_bypass_signature_verification

Conversation

@luis-ca

@luis-ca luis-ca commented Sep 1, 2020

Copy link
Copy Markdown

Implemented the ability to bypass signature verification as a way to help with upgrading to 2.x. I would suggest this be removed once we get to 3.x.

In our particular case, we do not control the configuration - our users can set up an integration with stripe by providing credentials. It so happens that users on older versions of the API were not required to provide a signing secret. Upgrading to 2.x therefore breaks these implementations.

By default, signature verification is enforced. Set the skip_signature_verification attribute to true to bypass verification.

StripeEvent.skip_signature_verification = true

The implementation relies on using Stripe::Event.construct_from directly.

@coveralls

coveralls commented Sep 1, 2020

Copy link
Copy Markdown

Coverage Status

Coverage decreased (-0.8%) to 99.174% when pulling 6ef8344 on fullfabric:ability_to_bypass_signature_verification into 5ef8578 on integrallis:master.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants