Webhook signature verification is implemented on all payment webhooks

Without webhook signature verification, any HTTP client on the internet can POST a fabricated payment_intent.succeeded event to your webhook endpoint and trigger order fulfillment, subscription activation, or credit grants — without paying anything. CWE-345 (Insufficient Verification of Data Authenticity) and CWE-352 (CSRF) both apply: an attacker replays or forges events, and your server acts on them as if they came from Stripe. PCI-DSS 4.0 Req 6.4 requires that payment event handling be protected against unauthorized manipulation. OWASP A07 (Identification and Authentication Failures) flags accepting unverified events as a complete authentication bypass.

Call stripe.webhooks.constructEvent() as the absolute first step after reading the raw body. If it throws, return 400 immediately — never fall through to business logic.

// app/api/webhooks/stripe/route.ts
export async function POST(req: Request) {
  const body = await req.text()  // raw — must not be pre-parsed
  const sig = (await headers()).get('stripe-signature')!

  let event: Stripe.Event
  try {
    event = stripe.webhooks.constructEvent(body, sig, process.env.STRIPE_WEBHOOK_SECRET!)
  } catch {
    return new Response('Invalid signature', { status: 400 })
  }

  // Business logic only reaches here after verification
  switch (event.type) { /* ... */ }
  return new Response('OK', { status: 200 })
}

Do not wrap constructEvent in a catch that swallows the error and continues — that negates the entire protection.