Skip to content

Prevent Stripe API calls after detecting the API keys are not valid (401 response from API) #4323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 16 commits into from
May 17, 2025
Merged

Prevent Stripe API calls after detecting the API keys are not valid (401 response from API) #4323

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
10fc910
Add transient to prevent api calls after getting a 401 response
diegocurbelo May 15, 2025
1063336
Update includes/class-wc-stripe-api.php
diegocurbelo May 15, 2025
5a11e7c
Update error response to empty json
diegocurbelo May 15, 2025
4f674ab
Remove invalid transient when saving new keys
diegocurbelo May 15, 2025
7ef8df3
Refactored to use get_option/update_option for concistency with how w…
diegocurbelo May 15, 2025
f90e45e
Update code comments
diegocurbelo May 15, 2025
1c7c8f5
Update account not connected notification message
diegocurbelo May 16, 2025
47b42d2
Show account as disconnected if the account data is not valid
diegocurbelo May 16, 2025
24ea6ea
Refactor 401 response to be null (needed for the Configure connection…
diegocurbelo May 16, 2025
9740ff3
Merge branch 'develop' into fix/handle-stripe-api-401-errors
diegocurbelo May 16, 2025
9666dcf
Clear account cache after detecting a 401 response
diegocurbelo May 16, 2025
cd43fc9
Add tests
diegocurbelo May 16, 2025
4d288fc
Simplify option keys in test
diegocurbelo May 16, 2025
52048d9
Fix success response mock
diegocurbelo May 16, 2025
13e6401
Add changelo entry
diegocurbelo May 16, 2025
ff5d7eb
Apply suggestions from code review
diegocurbelo May 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions client/settings/account-details/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,11 +133,11 @@ const AccountDetails = () => {
{ createInterpolateElement(
isTestModeEnabled
? __(
"Seems like the test API keys we've saved for you are no longer valid. If you recently updated them, use the <strong>Configure Connection</strong> button below to reconnect.",
"We couldn't connect to your account, it seems like the test API keys we've saved for you are no longer valid. Please use the <strong>Configure connection</strong> button below to reconnect.",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not urgent in this case. But, will this break internationalization of this string in the patch release?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That said, I think the trade-off for correctly communicating the status is probably worth it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, new strings need to be translated in the community translations site: https://translate.wordpress.org/projects/wp-plugins/woocommerce-gateway-stripe/

'woocommerce-gateway-stripe'
)
: __(
"Seems like the live API keys we've saved for you are no longer valid. If you recently updated them, use the <strong>Configure Connection</strong> button below to reconnect.",
"We couldn't connect to your account, it seems like the live API keys we've saved for you are no longer valid. Please use the <strong>Configure connection</strong> button below to reconnect.",
'woocommerce-gateway-stripe'
),
{
Expand Down
28 changes: 28 additions & 0 deletions includes/class-wc-stripe-api.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,20 @@ class WC_Stripe_API {
const ENDPOINT = 'https://api.stripe.com/v1/';
const STRIPE_API_VERSION = '2024-06-20';

/**
* The test mode invalid API keys option key.
*
* @var string
*/
const TEST_MODE_INVALID_API_KEYS_OPTION_KEY = 'wc_stripe_test_invalid_api_keys_detected';

/**
* The live mode invalid API keys option key.
*
* @var string
*/
const LIVE_MODE_INVALID_API_KEYS_OPTION_KEY = 'wc_stripe_live_invalid_api_keys_detected';

/**
* Secret API Key.
*
Expand Down Expand Up @@ -231,6 +245,13 @@ public static function request( $request, $api = 'charges', $method = 'POST', $w
* @param string $api
*/
public static function retrieve( $api ) {
// If we have an option flag indicating that the secret key is not valid, we dont't attempt the API call and we return an error.
$invalid_api_keys_option_key = WC_Stripe_Mode::is_test() ? self::TEST_MODE_INVALID_API_KEYS_OPTION_KEY : self::LIVE_MODE_INVALID_API_KEYS_OPTION_KEY;
$invalid_api_keys_detected = get_option( $invalid_api_keys_option_key );
if ( $invalid_api_keys_detected ) {
return json_decode( '' ); // The UI expects this empty response in case of invalid API keys.
}

WC_Stripe_Logger::log( "{$api}" );

$response = wp_safe_remote_get(
Expand All @@ -242,6 +263,13 @@ public static function retrieve( $api ) {
]
);

// If we get a 401 error, we know the secret key is not valid, we save a flag in the options to avoid making calls until the secret key gets updated.
if ( is_array( $response ) && ! empty( $response['response']['code'] ) && 401 === $response['response']['code'] ) {
update_option( $invalid_api_keys_option_key, true );
update_option( $invalid_api_keys_option_key . '_at', time() );
return json_decode( '' ); // The UI expects this empty response in case of invalid API keys.
}

if ( is_wp_error( $response ) || empty( $response['body'] ) ) {
WC_Stripe_Logger::log( 'Error Response: ' . print_r( $response, true ) );
return new WP_Error( 'stripe_error', __( 'There was a problem connecting to the Stripe API endpoint.', 'woocommerce-gateway-stripe' ) );
Expand Down
5 changes: 5 additions & 0 deletions includes/connect/class-wc-stripe-connect.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,11 @@ private function save_stripe_keys( $result, $type = 'connect', $mode = 'live' )
update_option( 'wc_stripe_' . $prefix . 'oauth_failed_attempts', 0 );
update_option( 'wc_stripe_' . $prefix . 'oauth_last_failed_at', '' );

// Clear the invalid API keys transient.
$invalid_api_keys_option_key = $is_test ? WC_Stripe_API::TEST_MODE_INVALID_API_KEYS_OPTION_KEY : WC_Stripe_API::LIVE_MODE_INVALID_API_KEYS_OPTION_KEY;
update_option( $invalid_api_keys_option_key, false );
update_option( $invalid_api_keys_option_key . '_at', time() );

if ( 'app' === $type ) {
// Stripe App OAuth access_tokens expire after 1 hour:
// https://docs.stripe.com/stripe-apps/api-authentication/oauth#refresh-access-token
Expand Down
Loading