Cancellation flow is complete

A cancellation button that doesn't call the Stripe API leaves the subscription active in Stripe — the user is still charged next month. Conversely, a cancellation that updates Stripe but has no webhook handler leaves your database showing active status after Stripe cancels — former subscribers retain premium access indefinitely. OWASP A01 (Broken Access Control) and CWE-284 (Improper Access Control) cover the access retention side. Failing to provide any self-serve cancellation path is also a compliance concern in many jurisdictions that require equal ease of cancellation as signup.

Implement cancellation with end-of-period access (most user-friendly), and ensure both the Stripe API call and the corresponding webhook handler are in place.

// app/api/billing/cancel/route.ts
export async function POST(req: Request) {
  const user = await getCurrentUser()
  await stripe.subscriptions.update(user.stripe_subscription_id, {
    cancel_at_period_end: true
  })
  await db.user.update({
    where: { id: user.id },
    data: { cancel_at_period_end: true }
  })
  return Response.json({ message: 'Subscription will cancel at period end' })
}

Then in your webhook handler, process customer.subscription.deleted to set plan: 'free' and subscription_status: 'canceled' when the billing period actually ends. Without the webhook handler, the cancellation UI is cosmetic only.