Package com.stripe.net

Class Webhook.Signature

java.lang.Object

com.stripe.net.Webhook.Signature

Enclosing class:

Webhook

public static final class Webhook.Signature
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
static final String	EXPECTED_SCHEME

Constructor Summary

Constructors

Constructor	Description
Signature()

Method Summary

Modifier and Type	Method	Description
static String	generateSignatureHeader(String payload, String secret)	Generates a Stripe-Signature header for the given payload and secret using the current timestamp.
static String	generateSignatureHeader(String payload, String secret, long timestamp)	Compute the Stripe-Signature header for a given webhook body & secret.
static boolean	verifyHeader(String payload, String sigHeader, String secret, long tolerance)	Verifies the signature header sent by Stripe.
static boolean	verifyHeader(String payload, String sigHeader, String secret, long tolerance, Clock clock)	Verifies the authenticity (and recency) of a webhook, throwing a SignatureVerificationException if there's a mismatch.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

EXPECTED_SCHEME

public static final String EXPECTED_SCHEME

See Also:

• Constant Field Values

Constructor Details

Signature

public Signature()

Method Details

verifyHeader

public static boolean verifyHeader(String payload,
 String sigHeader,
 String secret,
 long tolerance)
                            throws SignatureVerificationException

Verifies the signature header sent by Stripe. Throws a SignatureVerificationException if the verification fails for any reason.

Parameters:

payload - the payload sent by Stripe.

sigHeader - the contents of the signature header sent by Stripe.

secret - secret used to generate the signature.

tolerance - maximum difference allowed between the header's timestamp and the current time

Throws:

SignatureVerificationException - if the verification fails.

verifyHeader

public static boolean verifyHeader(String payload,
 String sigHeader,
 String secret,
 long tolerance,
 Clock clock)
                            throws SignatureVerificationException

Verifies the authenticity (and recency) of a webhook, throwing a SignatureVerificationException if there's a mismatch. Useful for quickly validating incoming webhooks before storing them for later processing (at which time you can use the *WithoutVerification methods for parsing).

Parameters:

payload - the payload sent by Stripe.

sigHeader - the contents of the signature header sent by Stripe.

secret - secret used to generate the signature.

tolerance - maximum difference allowed between the header's timestamp and the current time

clock - instance of clock if you want to use custom time instance

Throws:

SignatureVerificationException - if the verification fails.

generateSignatureHeader

public static String generateSignatureHeader(String payload,
 String secret)
                                      throws NoSuchAlgorithmException,
InvalidKeyException

Generates a Stripe-Signature header for the given payload and secret using the current timestamp.

Parameters:

payload - the payload to sign.

secret - the webhook secret.

Returns:

the generated signature header string.

Throws:

NoSuchAlgorithmException

InvalidKeyException

generateSignatureHeader

public static String generateSignatureHeader(String payload,
 String secret,
 long timestamp)
                                      throws NoSuchAlgorithmException,
InvalidKeyException

Compute the Stripe-Signature header for a given webhook body & secret. Useful for signing payloads in unit tests.

Parameters:

payload - the payload to sign.

secret - the webhook secret.

timestamp - the timestamp to use (seconds since epoch).

Returns:

the generated signature header string.

Throws:

NoSuchAlgorithmException

InvalidKeyException