Webhooks: Preventing Replay Attacks

Hi ! I don't know if this was already possible at the time you did the tutorial, but I changed the way of "checking" an event based on the documentation: https://stripe.com/docs/webhooks/signatures

I adapted this for Symfony, while keeping some of what we did in the training, which would look something like this:

public function stripeWebhookAction(Request $request, $shouldVerifyStripeEvent, $stripeWebhooksSecretKey)
{

        if ($shouldVerifyStripeEvent) {
            $header = 'Stripe-Signature';
            $signature = $request->headers->get($header);

            if (is_null($signature)) {
                throw new BadRequestHttpException(sprintf('Missing header %s', $header));
            }

            try {
                $stripeEvent = \Stripe\Webhook::constructEvent(
                    $request->getContent(),
                    $signature,
                    $stripeWebhooksSecretKey // The Stripe webhook key, you will find it in your Stripe dashboard, in your webhook configuration
                );
            } catch (\UnexpectedValueException $e) {
                throw new BadRequestHttpException('Invalid Stripe payload');
            } catch (SignatureVerificationException $e) {
                throw new BadRequestHttpException('Invalid Stripe signature');
            }
        } else {
            $stripeEvent = json_decode($request->getContent());
        }

        $eventId = $stripeEvent->id;
        $em = $this->getDoctrine()->getManager();
        $existingLog = $em->getRepository(StripeEventLog::class)->findOneBy(['stripeEventId' => $eventId]);

        if ($existingLog) {
            return new Response('Event previously handled !');
        }

        switch ($stripeEvent->type) {
           case '....':
           break;

           case '...':
           break:

          default:
            throw new \Exception('Unexpected webhook from Stripe '.$stripeEvent->type);
        }

        $log = new StripeEventLog($eventId);
        $em->persist($log);
        $em->flush();

        return new Response('Event handled: '.$stripeEvent->type);

There you go, I don't know if it's more secure, less secure, or if it's the same thing. But I hope it can help more than one person!