stripe-webhook-middleware

0.2.0 verified Sat Apr 25 auth: no javascript maintenance

Node.js Express middleware for validating incoming Stripe webhook events. Stable version 0.2.0, low release cadence. Differentiates by simple integration, but lacks signature verification (only validates event type), making it insecure for production use. Alternatives like @stripe/stripe-node provide proper signature verification. Only supports event validation; no email templates or callbacks yet.

Common errors

error Cannot find module 'stripe-webhook-middleware' ↓

cause Package not installed or typo in package name.

fix

Run 'npm install stripe-webhook-middleware' and verify package.json.

error TypeError: Cannot read properties of undefined (reading 'forEach') ↓

cause body-parser not applied before middleware; req.body is undefined.

fix

Add bodyParser.json() and bodyParser.urlencoded() calls before stripe middleware.

error stripeMiddleware.init is not a function ↓

cause Incorrect import: trying to call default export as function but it's an object with init property.

fix

Use const stripeMiddleware = require('stripe-webhook-middleware') and call stripeMiddleware.init(app, opts).

Warnings

gotcha No webhook signature verification: only validates event type, not authenticity. Attacker can send fake events. ↓

fix Use @stripe/stripe-node's webhook construction or raw body verification.

breaking Require both body-parser (json and urlencoded) before middleware; otherwise req.body is undefined. ↓

fix Ensure body-parser middleware is added before stripeMiddleware.

deprecated Package has not been updated since 2016; underlying Stripe API events have changed. ↓

fix Migrate to modern Stripe SDK or a maintained alternative.

Install

npm install stripe-webhook-middleware

yarn add stripe-webhook-middleware

pnpm add stripe-webhook-middleware

Imports

default

wrong

import stripeMiddleware from 'stripe-webhook-middleware'

correct

const stripeMiddleware = require('stripe-webhook-middleware')

CJS only; not ESM-compatible.

init

wrong

const stripeMiddleware = require('stripe-webhook-middleware'); stripeMiddleware.init(app, opts)

correct

const { init } = require('stripe-webhook-middleware')

init is exported as a function; destructuring works but calling stripeMiddleware.init is also valid.

Quickstart

Creating an Express endpoint that validates Stripe webhook events using the middleware.

const express = require('express');
const bodyParser = require('body-parser');
const stripeMiddleware = require('stripe-webhook-middleware');

const app = express();
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: false }));

app.post('/stripe', stripeMiddleware.init(app, {
  stripeApiKey: process.env.STRIPE_API_KEY ?? ''
}));

app.listen(3000);