nginxstripe-payments

Redirecting Requests to https breaks Stripe webhook


I recently modified my nginx server to redirect all www.mysite requests to https://mysite

The problem is that when I did that, my stripe webhook I had set up is now failing with a 301 redirect error. How do I alter my nginx server to that only requests coming from my domain are redirected? (or at least I think that's the solution, I'm a front end guy).

Here's my server.

server {
    listen 443;
    server_name mysite.com;
    root /var/www/mysite.com/app/mysite;

    ssl on;
    ssl_certificate /etc/nginx/ssl/cert.crt;
    ssl_certificate_key /etc/nginx/ssl/mykey.key;

    #enables SSLv3/TLSv1, but not SSLv2 which is weak and should no longer be used.
    ssl_protocols SSLv3 TLSv1;
    #Disables all weak ciphers
    ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;


    location / {
        proxy_pass        http://127.0.0.1:3000/;
        proxy_redirect    off;
        proxy_set_header  Host            $host;
        proxy_set_header  X-Real-IP        $remote_addr;
        proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    }
}

server {
  listen 80;
  server_name www.mysite.com;
  return 301 https://mysite.com$request_uri;
}

Solution

  • As mpcabd mentioned, Stripe webhooks will not follow redirects for security reasons. As he also mentioned, while you can filter by IP, it's a never-ending battle (and Stripe has previously stated they do intend to eventually stop publishing an IP list).

    The even easier and better set-it-and-forget-it solution:

    In the Stripe dashboard, reconfigure your webhooks to use HTTPS.

    Bam. Done.