为什么Stripe不使用公钥加密来签署Webhooks？
来自 docs ：
Stripe可以选择通过在每个事件的Stripe-Signature标头中加入签名来签名它发送到您的端点的Webhook事件。这使您可以验证事件是通过条纹发送的，而不是由第三方发送的。您可以使用我们的官方库验证签名，也可以手动使用自己的解决方案。
在验证签名之前，您需要从仪表板的Webhooks设置中检索端点的秘密。选择要获取秘密的端点，然后单击单击以显示按钮。
最后一段表明，秘密确实是秘密对待的东西。 Stripe不使用私人钥匙方案签署Webhook事件的原因是有原因的吗？
他们可以将私钥保留在DB中，从不在UI上显示它。 UI只会显示公钥。通过条纹向Webhook提出的每个请求都将使用私钥签名，并在接收端用公共密钥进行验证。这样，恶意演员可以使用公共密钥是无关紧要的，因为他们只能将其用于验证，而现在 - 我认为 - 一个意外揭示的秘密可以用于伪造。
From the docs:
Stripe can optionally sign the webhook events it sends to your endpoints by including a signature in each event’s Stripe-Signature header. This allows you to verify that the events were sent by Stripe, not by a third party. You can verify signatures either using our official libraries, or manually using your own solution.
Before you can verify signatures, you need to retrieve your endpoint’s secret from your Dashboard’s Webhooks settings. Select an endpoint that you want to obtain the secret for, then click the Click to reveal button.
The last paragraph suggests that the secret is truly something to be treated confidentially. Is there a reason why Stripe doesn't use a private-public key scheme for signing webhook events?
They could keep the private key in their DB, never displaying it on the UI. The UI would only show the public key. Every request made to a webhook by Stripe would be signed with the private key and verified at the receiving end with the public key. This way, malicious actors getting access to the public key would be irrelevant, as they could only use it for verification, whereas now — I assume — an accidentally revealed secret can be used for forgery.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我既不是Stripe的员工，也不是Stripe专家，但我认为您的问题来自理想的世界，从您的角度来看，HMAC与数字签名相比具有缺点。我想这一决定背后的主要原因是计算复杂性。但是为了真理，为什么您不考虑这个问题以及相关因素？条纹预防重播攻击并发布他们的 ip adresses 。综上所述，这些措施为伪造信息提供了非常真实的保护。
I'm neither a Stripe employee nor a Stripe expert, but I think your question comes from an ideal world where HMAC has disadvantages compared to digital signature from the point of view you're standing on. I suppose the main reason behind this decision is the computational complexity. But for the sake of truth, why you don't consider this problem along with related factors? Stripe prevents replay attacks and publish their ip adresses. Taken together, these measures provide very real protection against message forgery.