Hey there,
I’m implementing Stripe Checkout on my website.
Everything is working fine, except Cloudflare blocking the webhook stripe is sending to validate a transaction.
I’ve realized this issue while pausing cloudflare on my website : I receive webhooks only when cloudflare is paused.
I’ve created two page rules with a disable security on my webhook url.
And also added a Firewall rule to register stripe Webhooks IP addresses :
Can you add the stripe IP addresses, with an action simply of “Allow”. Then ensure that firewall rule is the first one in the list of any rules you have.
What I sometimes do if I can’t get a full list of IP addresses for such a service, is to instead whitelist the URI of the webhook endpoints. This does expose your site to attack via those endpoints, but it’s probably unlikely to happen.
Change “/stripe/endpoint.asp” to the URI that Stripe connects back to on your website. You might need to add more than one URI using an “OR” condition. If you’re not sure what these URIs are, consult the Stripe documentation, or in your account go to Firewall > Overview and find the entries where Stripe is being blocked. You can then probably figure out the URIs from there.
Remember to make this firewall rule one of the first in the list.
If you’re using Firewall Rules, then this implies there’s something in the Firewall Event Log that’s showing the blocked access. Have you found the relevant entries?
As Sdayman said, what does the Firewall event log show? Can you see the requests from Stripe in there? Are they allowed or blocked? If blocked, which rule is listed as being triggered?
I also notice that the webhook link you posted is returning a 400 Bad Request error and in the source code it says, “Undefined index: HTTP_STRIPE_SIGNATURE” - may or may not be related to your issue.
The stripe team is telling me about asking : what is it in my configuration that is causing a 307 redirect when sending POST requests to my endpoint, and how can I ensure that it returns a 200 OK (i.e., the server response) instead
Yep, I can see the logs on my server, but only the ones which have a 200 code, I assume the other ones are intercepted by cloudflare before arriving on my server
When Cloudflare is activated and you make a test payment and don’t see an entry in the log at your origin server, what does the entry say in the Cloudflare Firewall event history? Can you confirm an entry appears there with an action of “allow” at the precise time of you placing the test payment?
