Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Webhook event payload for account.application.authorized / account.application.deauthorized has incorrect API version #928

Open
clement911 opened this issue Aug 8, 2023 · 7 comments
Labels
app-platform bug Something isn't working

Comments

@clement911
Copy link

Even though our webhook endpoints are pinned to a specific API version, whenever we received events for account.application.authorized / account.application.deauthorized , it seems that the api version field has the value of the account that is being authorized/deauthorized instead of the value of our pinned webhook API version.

@clement911 clement911 added bug Something isn't working needs-triage labels Aug 8, 2023
@gabrielhurley-stripe
Copy link
Contributor

Thanks for the report! We're tracking the issue internally; it's a bug on our end. I don't have an ETA for the fix, but it is on our list.

@clement911
Copy link
Author

Just circling to check if there is any progress on this issue?

It's definitely very counter intuitive.

@gabrielhurley-stripe
Copy link
Contributor

Unfortunately I still don't have an ETA. The issue is owned by another team and this hasn't made it into their current prioritization yet. I've bumped the ticket internally to see if they can move it up.

@matthew-macgregor
Copy link

We've encountered this issue as well. @clement911, thanks for submitting this issue, and did you find a reasonable workaround?

Is there any progress on resolving this, @gabrielhurley-stripe?

@bensontrent
Copy link

I don't see this as a bug as we perform actions on the user's invoice metadata to indicate if the item is unshipped. We require the user's API version to perform the correct action on our connected accounts. For example:

import Stripe from 'stripe'

const stripe = new Stripe(process.env.STRIPE_API_KEY!);


// Receive event here with additional logic

const perhapsMarkInvoiceUnshipped = async (event: Stripe.Event) => {

  if (event.type === 'invoice.created' && event.account && event.api_version) {

    if (event.data.object.shipping_cost) {
      await markInvoiceAsUnshipped(event.account, event.data.object.id, event.api_version)
    }
  }

}

const markInvoiceAsUnshipped = async (accountId: string, invoiceId: string, apiVersion: string) => {

  const invoice = await stripe.invoices.update(invoiceId,
    {
      metadata: {
        "ship_status": "unshipped"
      }
    },
    {
      stripeAccount: accountId,
      apiVersion: apiVersion
    }
  );
}

@matthew-macgregor
Copy link

matthew-macgregor commented Apr 16, 2024

Thanks for the example. We'll take a closer look. For more information, we are using the Stripe dotnet library.

At least in the dotnet client, the API Version field is validated during deserialization and throws an exception on API Version mismatch. There is a flag available to override this behavior, but I think we actually want this validation to occur. The official advice is to pin SDK version and API version, as seen here: https://docs.stripe.com/api/versioning

Because stripe-dotnet is strongly typed, the requests you send align with the API version current at your stripe-dotnet version’s release time. If you want to use a newer or older API version, consider upgrading or downgrading your stripe-dotnet version. Use the stripe-dotnet changelog to find which versions include the API version you need.

Example of the exception:

Received event with API version 2017-06-05, but Stripe.net 43.0.0 expects API version 2023-10-16. We recommend that you create a WebhookEndpoint with this API version. Otherwise, you can disable this exception by passing `throwOnApiVersionMismatch: false` to `Stripe.EventUtility.ParseEvent` or `Stripe.EventUtility.ConstructEvent`, but be wary that objects may be incorrectly deserialized.

I think it still should be classified as a bug based on this.

@clement911
Copy link
Author

This is definitely a bug and it is has nothing to do with invoices or with the .NET library.
Webhook endpoints are pinned to a specific API version and Stripe is supposed to use that version when sending events. That's all there is to understand.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
app-platform bug Something isn't working
Projects
None yet
Development

No branches or pull requests

4 participants