Skip to content

fix(webhook): decode request body to string to avoid Buffer in Deno#199

Open
matingathani wants to merge 1 commit intostripe:mainfrom
matingathani:issue-170-buffer-deno
Open

fix(webhook): decode request body to string to avoid Buffer in Deno#199
matingathani wants to merge 1 commit intostripe:mainfrom
matingathani:issue-170-buffer-deno

Conversation

@matingathani
Copy link
Copy Markdown

Summary

The Stripe SDK calls Buffer.isBuffer() internally when processing the webhook payload. Buffer is a Node.js global that doesn't exist in the Deno edge function runtime, causing:

ReferenceError: Buffer is not defined
  at _StripeSyncWebhook.processWebhook (index.ts:47309:65)

Root cause: stripe-webhook.ts passed a Uint8Array to processWebhook, which forwarded it to the Stripe SDK's constructEventAsync. The SDK's internal signature computation checks Buffer.isBuffer(payload) — in Deno that throws instead of returning false.

Fix: Decode the ArrayBuffer to a UTF-8 string before calling processWebhook. The Stripe signature verification works correctly on strings, and the string code path in the SDK never references Buffer.

Test plan

  • Deploy the edge function to a Supabase project and fire a test webhook — verify { received: true } response with no Buffer is not defined error
  • Verify signature rejection still works by sending a webhook with a wrong secret

Closes #170

The Stripe SDK internally calls Buffer.isBuffer() when processing
the webhook payload. Buffer is a Node.js global that does not exist
in the Deno edge function runtime, which causes a ReferenceError.

Decoding the raw ArrayBuffer to a UTF-8 string before passing it
to processWebhook avoids the Buffer check entirely, since the SDK
only performs the Buffer-specific code path for Buffer instances.

Closes stripe#170
Copilot AI review requested due to automatic review settings March 30, 2026 01:05
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Supabase (Deno) edge webhook handler to avoid a runtime crash caused by the Stripe SDK referencing the Node.js-only Buffer global during webhook signature verification.

Changes:

  • Read the webhook body as an ArrayBuffer and decode it to a UTF-8 string.
  • Pass the decoded string payload into stripeSync.webhook.processWebhook(...) instead of a Uint8Array.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

stripe-webhook: Webhook processing error: ReferenceError: Buffer is not defined

2 participants