Stripe Webhook: event verification

[kylehotchkiss]

Since anybody can POST to the webhooks path, we should verify eventID with Stripe's API upon receiving an event

[ccorda]

They mention basic auth in their docs, what do you think about using that to help since FUP urls will be pretty guessable?

The mode determines whether test events or live events are sent to this URL; if you want to send both live and test events to the same URL, you need to create two separate settings. You may add as many URLs as you like, and basic access authentication is supported

They also have this https://stripe.com/docs/webhooks#signatures -- is that what you were thinking?

[kylehotchkiss]

Signatures accomplishes exactly what we want, I didn't realize that was in there. Thanks!