Stripe webhook authentication - Ruby

Question

My ruby-on-rails application uses stripe for card payments. Stripe has a provision of webhooks through which it contacts back to my application and gives details about every transactions - succeeded or failed.

For this, I have in my controller something like this:

class StripeController < ApplicationController
  def webhook
    data_json = JSON.parse request.body.read
    p data_json['data']['object']['customer']
  end

My question is how can I validate the authenticity of this webhook? To my knowledge and understanding one can easily imitate this (man-in-the-middle attack).

Answer 1

From Stripe's webhooks documentation:

If security is a concern, or if it's important to confirm that Stripe sent the webhook, you should only use the ID sent in your webhook and should request the remaining details from the Stripe API directly.