How to Test Webhooks Locally and Expose Your Development Server to the Internet

Stripe-Signature: t=1740000000,v1=4f3a2b1c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a

const express = require('express');
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

const app = express();

// IMPORTANT: Use express.raw() for this route, NOT express.json()
// Stripe signature verification requires the raw body bytes.
app.post('/webhook/stripe', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['stripe-signature'];
  const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET; // starts with whsec_

  let event;
  try {
    event = stripe.webhooks.constructEvent(req.body, signature, endpointSecret);
  } catch (err) {
    console.error('Signature verification failed:', err.message);
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }

  // IMPORTANT: Respond with 200 IMMEDIATELY, before doing any async work.
  // Stripe requires a response within 5 seconds. If you timeout,
  // Stripe will retry the webhook (potentially causing duplicate processing).
  res.json({ received: true });

  // Process the event asynchronously after responding
  handleStripeEvent(event);
});

async function handleStripeEvent(event) {
  switch (event.type) {
    case 'payment_intent.succeeded':
      const paymentIntent = event.data.object;
      console.log('Payment succeeded:', paymentIntent.id, paymentIntent.amount);
      // fulfill order, send confirmation email, update database...
      break;

    case 'customer.subscription.deleted':
      const subscription = event.data.object;
      console.log('Subscription cancelled:', subscription.id);
      // update user's plan in database, revoke access...
      break;

    case 'checkout.session.completed':
      const session = event.data.object;
      console.log('Checkout completed:', session.id);
      break;

    default:
      console.log('Unhandled event type:', event.type);
  }
}

app.listen(3000, () => console.log('Webhook server running on port 3000'));

const express = require('express');
const crypto = require('crypto');

const app = express();

// Use raw body for signature verification (same reason as Stripe)
app.post('/webhook/github', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-hub-signature-256'];
  const event = req.headers['x-github-event'];
  const deliveryId = req.headers['x-github-delivery'];

  if (!signature) {
    return res.status(401).send('Missing signature');
  }

  // Verify the HMAC-SHA256 signature
  const hmac = crypto.createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET);
  hmac.update(req.body);
  const expectedSignature = 'sha256=' + hmac.digest('hex');

  // Use timingSafeEqual to prevent timing attacks
  const sigBuffer = Buffer.from(signature);
  const expectedBuffer = Buffer.from(expectedSignature);

  if (sigBuffer.length !== expectedBuffer.length ||
      !crypto.timingSafeEqual(sigBuffer, expectedBuffer)) {
    return res.status(401).send('Invalid signature');
  }

  // Respond immediately — GitHub times out after 10 seconds
  res.status(200).send('OK');

  // Parse and process asynchronously
  const payload = JSON.parse(req.body.toString());
  handleGitHubEvent(event, deliveryId, payload);
});

function handleGitHubEvent(event, deliveryId, payload) {
  console.log(`Received ${event} event (delivery: ${deliveryId})`);

  switch (event) {
    case 'push':
      const branch = payload.ref.replace('refs/heads/', '');
      const pusher = payload.pusher.name;
      const commits = payload.commits.length;
      console.log(`${pusher} pushed ${commits} commit(s) to ${branch}`);
      // trigger CI/CD, send Slack notification, update deployment status...
      break;

    case 'pull_request':
      const action = payload.action; // opened, closed, merged, etc.
      const prNumber = payload.number;
      const prTitle = payload.pull_request.title;
      console.log(`PR #${prNumber} ${action}: ${prTitle}`);
      break;

    case 'issues':
      console.log(`Issue ${payload.action}: ${payload.issue.title}`);
      break;

    default:
      console.log(`Unhandled event: ${event}`);
  }
}

app.listen(3000, () => console.log('GitHub webhook server running on port 3000'));

import stripe
import os
from flask import Flask, request, jsonify

app = Flask(__name__)
stripe.api_key = os.environ['STRIPE_SECRET_KEY']
endpoint_secret = os.environ['STRIPE_WEBHOOK_SECRET']

@app.route('/webhook/stripe', methods=['POST'])
def stripe_webhook():
    payload = request.get_data()  # raw bytes, not parsed JSON
    signature = request.headers.get('Stripe-Signature')

    try:
        event = stripe.Webhook.construct_event(payload, signature, endpoint_secret)
    except stripe.error.SignatureVerificationError as e:
        return jsonify(error=str(e)), 400

    # Respond immediately
    response = jsonify(received=True)

    # Handle event types
    if event['type'] == 'payment_intent.succeeded':
        payment_intent = event['data']['object']
        print(f"Payment succeeded: {payment_intent['id']}")

    elif event['type'] == 'customer.subscription.deleted':
        subscription = event['data']['object']
        print(f"Subscription cancelled: {subscription['id']}")

    return response

if __name__ == '__main__':
    app.run(port=3000)

<?php
$secret = getenv('GITHUB_WEBHOOK_SECRET');

// Read raw body before any output
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_HUB_SIGNATURE_256'] ?? '';
$event = $_SERVER['HTTP_X_GITHUB_EVENT'] ?? '';
$delivery = $_SERVER['HTTP_X_GITHUB_DELIVERY'] ?? '';

// Verify signature
$expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Respond immediately
http_response_code(200);
header('Content-Type: application/json');
echo json_encode(['received' => true]);

// Flush output to the client before continuing processing
// This ensures GitHub receives the 200 within the timeout window
ob_flush();
flush();

// Now process the event
$data = json_decode($payload, true);

switch ($event) {
    case 'push':
        $branch = str_replace('refs/heads/', '', $data['ref']);
        $pusher = $data['pusher']['name'];
        error_log("Push to {$branch} by {$pusher}");
        break;

    case 'issues':
        error_log("Issue {$data['action']}: {$data['issue']['title']}");
        break;
}