Defensive Architecture: Logic Flaw: Stripe Webhook Signature Bypass

The vulnerability stems from a middleware ordering issue. When `express.json()` is used globally, it converts the raw request buffer into a JSON object. Stripe's signature verification requires the *exact* raw bytes of the payload. If the body is re-stringified, even a single space difference causes the HMAC-SHA256 signature to fail. Developers often 'fix' this by disabling signature checks entirely to get the code working, leading to 1,500+ apps currently accepting forged payment events.

app.post('/api/webhook/stripe', express.json(), (req, res) => {
  // TRAP: express.json() parses body before signature check
  const sig = req.headers['stripe-signature'];
  // constructEvent fails because req.body is no longer a raw buffer
  const event = stripe.webhooks.constructEvent(req.body, sig, secret);
});

Use `express.raw({type: 'application/json'})` specifically for the webhook route to preserve the buffer, ensuring the HMAC calculation matches the sender's signature.