Ship It Checklist

Checklists /Cloudflare /Payments

Critical

Verify payment webhooks before you fulfil an order

A Worker route that marks an order paid on any JSON body will be found. Verify the provider's signature on the raw body, with the endpoint secret stored as a Wrangler secret, and only then fulfil.

How to check

  1. The handler reads request.text() or the raw bytes before it parses JSON.
  2. It checks the signature header with the official helper.
  3. The secret is env.STRIPE_WEBHOOK_SECRET or the equivalent, not a string in the file.
  4. A request with no signature returns 400 and does not change the order.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: payment webhooks are verified before any order is fulfilled.

Steps:
1. Find the webhook handler.
2. Verify the signature on the raw body using the provider's library and a secret from env.
3. Return 400 when verification fails, and do not write.
4. On success, update the order once. Make a second delivery of the same event id a no-op if you already store event ids.
5. Do not print the secret. Name the Wrangler secret I must set.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes