Registry / payments / stripe-webhook-middleware

stripe-webhook-middleware

library0.2.0jsnpmunverified

Node.js Express middleware for validating incoming Stripe webhook events. Stable version 0.2.0, low release cadence. Differentiates by simple integration, but lacks signature verification (only validates event type), making it insecure for production use. Alternatives like @stripe/stripe-node provide proper signature verification. Only supports event validation; no email templates or callbacks yet.

payments web-framework

npm install stripe-webhook-middleware

github ↗package ↗

INSTALL

IMPORT

SIG · STRIPE-WEBHOOK-MID

stripe-webhook-middleware

paymentsjavascriptv0.2.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ const stripeMiddleware = require('stripe-webhook-middleware')

✗ import stripeMiddleware from 'stripe-webhook-middleware'

CJS only; not ESM-compatible.

init

✓ const { init } = require('stripe-webhook-middleware')

✗ const stripeMiddleware = require('stripe-webhook-middleware'); stripeMiddleware.init(app, opts)

init is exported as a function; destructuring works but calling stripeMiddleware.init is also valid.

Creating an Express endpoint that validates Stripe webhook events using the middleware.

const express = require('express'); const bodyParser = require('body-parser'); const stripeMiddleware = require('stripe-webhook-middleware'); const app = express(); app.use(bodyParser.json()); app.use(bodyParser.urlencoded({ extended: false })); app.post('/stripe', stripeMiddleware.init(app, { stripeApiKey: process.env.STRIPE_API_KEY ?? '' })); app.listen(3000);

Debug

Known issues

gotchaNo webhook signature verification: only validates event type, not authenticity. Attacker can send fake events.

fix

Use @stripe/stripe-node's webhook construction or raw body verification.

affects: <=0.2.0

breakingRequire both body-parser (json and urlencoded) before middleware; otherwise req.body is undefined.

fix

Ensure body-parser middleware is added before stripeMiddleware.

affects: <=0.2.0

deprecatedPackage has not been updated since 2016; underlying Stripe API events have changed.

fix

Migrate to modern Stripe SDK or a maintained alternative.

affects: <=0.2.0

Errors

Common errors & fixes

Cannot find module 'stripe-webhook-middleware'

Package not installed or typo in package name.

fix

Run 'npm install stripe-webhook-middleware' and verify package.json.

TypeError: Cannot read properties of undefined (reading 'forEach')

body-parser not applied before middleware; req.body is undefined.

fix

Add bodyParser.json() and bodyParser.urlencoded() calls before stripe middleware.

stripeMiddleware.init is not a function

Incorrect import: trying to call default export as function but it's an object with init property.

fix

Use `const stripeMiddleware = require('stripe-webhook-middleware')` and call `stripeMiddleware.init(app, opts)`.

Upgrade

Version history

0.2.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

36 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/eddywashere/stripe-webhook-middleware ↗

packagehttps://www.npmjs.com/package/stripe-webhook-middleware ↗