Are Webhooks neccesary?

Hello vdrn

Thank you for contacting WooCommerce Support.

Webhooks are not required for many standard operations of WooCommerce and the Stripe payment gateway but webhooks do play an important role when it comes to tracking events that occur with transactions.

For live mode operation, webhooks become essential for updating order statuses automatically when certain asynchronous events happen – such as chargebacks or refunds – that occur post-payment and require the system to be notified.

Although your store can operate without them, enabling webhooks ensures that your WooCommerce store stays in sync with Stripe for any post-payment events and reduces the need for manual updates, thereby making the process seamless for both you and your customers.

I hope this answers your question.
If you have any further queries, please feel free to reach out. ??

Best regards.

Thanks so much @doublezed2 for a quick response.

I have a follow-up question: In order for webhooks to work properly, is adding a webhook secret in woocommerce-gateway-stripe? settings strictly necessary?
(I beleive woocommerce-gateway-stripe can alternately use useragent checking to verify webhooks, which makes secret key optional)

Hello vdrn,

Thank you for your reply.

Yes, that is correct.
Adding a webhook secret is a required step of the configuration process.
Without it, the communication between Stripe and WooCommerce will not happen.

Could you share more details about what you mean by:
useragent checking to verify webhooks

Please let me know if you have any other questions.
I will be happy to answer. ??

Best regards.

I was hoping that secret is not strictly required when using webhooks. (I’m using multiple stripe accounts for my shop, and while publishable and secret keys can be changed by filter hooks easily, there is no such functionality for webhook secret).

More details on useragent checking to verify webhooks:

This code calls validate_request_user_agent when there is no wehbook secret: https://github.com/woocommerce/woocommerce-gateway-stripe/blob/44584a226cdd0008d78513eeb0140b889ccc556c/includes/class-wc-stripe-webhook-handler.php#L108

I’m quoting the comment to the function called there:
Verify User Agent of the incoming webhook notification. Used as fallback for the cases when webhook secret is missing.

(link to the comment: https://github.com/woocommerce/woocommerce-gateway-stripe/blob/44584a226cdd0008d78513eeb0140b889ccc556c/includes/class-wc-stripe-webhook-handler.php#L136)

Hi there @vdrn,

Just as my colleague has shared above, it is important for the webhooks to be enabled, as they do play an important role when it comes to tracking events that occur with transactions.

However, the plugin does have a fallback mechanism in place when the webhook secret is missing. The validate_request_user_agent function you’ve mentioned checks the incoming webhook notification to verify that it’s from Stripe. This is not as secure as the secret, but it does provide a basic level of verification and communication.

I hope this helps.

@ckadenge Thank you. I guess my only option is to modify the plugin.

Hello vdrn,

Thank you for your reply.
We are glad to be of your help.

Please don’t hesitate to contact us again if you have more questions or concerns.
We are here to help ??

Best regards.