Module: Yookassa::Webhook::IpChecker

Defined in:
lib/yookassa/webhook/ip_checker.rb

Overview

Validates webhook request source IPs against YooKassa's trusted networks.

Use this in your webhook endpoint to verify that requests actually come from YooKassa and not from a third party.

Examples:

Rails before_action

before_action :verify_yookassa_ip, only: :webhook

def verify_yookassa_ip
  head :forbidden unless Yookassa::Webhook::IpChecker.trusted?(request.remote_ip)
end

See Also:

Constant Summary collapse

TRUSTED_NETWORKS =

YooKassa's trusted IP networks (IPv4 and IPv6).

[
  IPAddr.new("185.71.76.0/27"),
  IPAddr.new("185.71.77.0/27"),
  IPAddr.new("77.75.153.0/25"),
  IPAddr.new("77.75.156.11"),
  IPAddr.new("77.75.156.35"),
  IPAddr.new("77.75.154.128/25"),
  IPAddr.new("2a02:5180::/32")
].freeze

Class Method Summary collapse

Class Method Details

.trusted?(ip) ⇒ Boolean

Checks whether the given IP belongs to a YooKassa trusted network.



36
37
38
39
40
41
 
# File 'lib/yookassa/webhook/ip_checker.rb', line 36

def self.trusted?(ip)
  addr = IPAddr.new(ip.to_s)
  TRUSTED_NETWORKS.any? { |network| network.include?(addr) }
rescue IPAddr::InvalidAddressError
  false
end