python - How to secure a webhook in Django using Stripe -

i have webhook view receives post requests payment gateway. identifies customer , updates amount provided data.

this can exploited if webhook url somehow gets leaked.

for e.g.

curl --data "cust_no=xxxxxxxxxx&amount=1000" https://example.com/wallet/payment_webhook/ 

how can make secure doesn't accept such requests? should validate request coming payment gateway.

update:

the webhook request contains transaction details along customer number.

it's explicitly documented on webhooks documentation:

best practices

[...]

for optimum security, can confirm event data stripe before acting upon it. so:

1. parse json data above.
2. grab received event object id value.
3. use event object id in retrieve event api call.
4. take action using returned event object.

see webhook-mailer working example. pay particular attention this line:

# retrieving event stripe api guarantees authenticity   event = stripe::event.retrieve(data[:id])