Hacker News Reader

Comment by hislaziness | Hacker News Reader

Definitely Stripe should have done a better job here. However, also points to the risk of allowing service providers to handle your security. Maybe there should have been a back test and or a "maker" "checker" control for pushing new security rules.

View on HN

Cloudflare is blocking the shit out of legitimate requests, how is this Stripes fault?

Putting the webhook callback behind CloudFlare was the mistake IMO.

Yes - Stripe is even nice enough to provide a list of IP addresses their webhook requests could come from [1]

And Cloudflare is well known for randomly throwing up "Checking your browser before accessing example.com" interstitials and captchas and suchlike - of course you don't want bot detection on your callback API.

[1] https://stripe.com/docs/ips?locale=en-GB#webhook-notificatio...

A customer I work with has a large Drupal site hosted with a big time Drupal provider. Cloudflare has decided that image uploads from the browser via the JS uploader needs to be checked and injects itself into that...but the browser has no way to display it so the page just hangs. Its awful.

Indeed, in the end Troy disabled a certain rule for incoming requests from Stripe but not all. Just before publishing the article he discovered more (webhook) requests being blocked by a different rule. This seems like a continuous source of issues where valid (webhook) requests are being (arbitrarily) blocked. Why wouldn't you just disable all rules for requests coming from Stripe?

Reply on news.ycombinator.com