Razorpay Webhooks and Security Verifying Signatures and Preventing Fraud

Razorpay Webhooks and Security

Securing your payment integration is critical. This guide covers webhook security, signature verification, and fraud prevention.

1. Always Verify Webhook Signatures

router.post("/webhook", express.raw({ type: "application/json" }), 
  asyncHandler(async (req, res) => {
    const webhookSecret = process.env.RAZORPAY_WEBHOOK_SECRET;
    const signature = req.headers["x-razorpay-signature"];
    
    // Verify signature
    const expectedSignature = crypto
      .createHmac("sha256", webhookSecret)
      .update(req.body) // Must be raw body, not parsed
      .digest("hex");
    
    if (expectedSignature !== signature) {
      console.error("Invalid webhook signature");
      return res.status(400).json({ message: "Invalid signature" });
    }
    
    // Signature verified   process the event
    const event = JSON.parse(req.body.toString());
    // ... handle event ...
    
    res.status(200).json({ status: "ok" });
  })
);

Important: Use express.raw() for the webhook route, not express.json(). The signature is computed on the raw body.

2. Prevent Replay Attacks

A replay attack is when the same webhook is sent multiple times. Handle this with idempotency:

const handlePaymentCaptured = async (payment) => {
  // Check if we already processed this payment
  const existing = await Payment.findOne({ paymentId: payment.id });
  if (existing && existing.status === "paid") {
    console.log("Payment already processed, skipping");
    return;
  }
  
  // Process the payment
  const dbPayment = await Payment.findOne({ orderId: payment.order_id });
  if (dbPayment) {
    dbPayment.paymentId = payment.id;
    dbPayment.status = "paid";
    await dbPayment.save();
    
    await User.findByIdAndUpdate(dbPayment.userId, {
      isPremium: true
    });
  }
};

3. Store the Webhook Secret Securely

# .env (never committed)
RAZORPAY_WEBHOOK_SECRET=your_webhook_secret

# Set up the webhook URL in Razorpay Dashboard:
# Settings → Webhooks → Add New Webhook
# URL: https://api.yourdomain.com/api/payment/webhook
# Events: payment.captured, payment.failed, refund.processed
# Secret: your_webhook_secret

4. Use HTTPS Only

Webhooks must be on HTTPS. Razorpay won't send webhooks to HTTP URLs in production:

# Ensure your Nginx has SSL configured
# URL: https://api.yourdomain.com/api/payment/webhook

5. Never Trust Frontend Data

// WRONG   trusting frontend amount
router.post("/create-order", asyncHandler(async (req, res) => {
  const order = await razorpay.orders.create({
    amount: req.body.amount * 100, // User could modify this!
  });
}));

// RIGHT   verify amount on backend
router.post("/create-order", asyncHandler(async (req, res) => {
  const { plan } = req.body;
  
  // Get amount from your database, not the frontend
  const planDetails = await Plan.findOne({ name: plan });
  if (!planDetails) throw new AppError("Invalid plan", 400);
  
  const order = await razorpay.orders.create({
    amount: planDetails.price * 100, // Amount from database
    currency: "INR",
    receipt: `receipt_${Date.now()}`
  });
}));

6. Verify Payment Amount

const handlePaymentCaptured = async (payment) => {
  const dbPayment = await Payment.findOne({ orderId: payment.order_id });
  
  // Verify the amount matches
  if (dbPayment.amount !== payment.amount) {
    console.error("Amount mismatch!", {
      expected: dbPayment.amount,
      received: payment.amount
    });
    await sendAlert("Payment amount mismatch   possible fraud");
    return;
  }
  
  // Amount verified   proceed
  dbPayment.status = "paid";
  await dbPayment.save();
};

7. Log Everything

// Log all webhook events for audit
await WebhookLog.create({
  event: event.event,
  entityId: event.payload.payment?.entity?.id,
  signature: signature,
  receivedAt: new Date(),
  processed: true
});

Security Checklist

• Webhook signature verified on every request
• Webhook secret in .env (not in code)
• HTTPS only for webhook URL
• express.raw() for webhook route (not express.json())
• Idempotency handle duplicate webhooks
• Amount verified against database
• Amount comes from database, not frontend
• API keys in .env (not in code or frontend)
• Refunds require admin authorization
• All webhooks logged for audit
• Test mode used during development
• Webhook URL not publicly documented

The Takeaway

Razorpay security involves: always verifying webhook signatures with HMAC-SHA256, using express.raw() for the webhook route (not express.json()), preventing replay attacks with idempotency checks, never trusting frontend data (get amounts from the database), verifying payment amounts match the order, using HTTPS only, storing secrets in .env, logging all webhooks for audit, and requiring admin authorization for refunds.