module StripeEvent
  class WebhookController < ActionController::Base
    if respond_to?(:before_action)
      before_action :request_authentication
    else
      before_filter :request_authentication
    end

    def event
      StripeEvent.instrument(params)
      head :ok
    rescue StripeEvent::UnauthorizedError => e
      log_error(e)
      head :unauthorized
    end

    private

    def log_error(e)
      logger.error e.message
      e.backtrace.each { |line| logger.error "  #{line}" }
    end

    def request_authentication
      if StripeEvent.authentication_secret
        authenticate_or_request_with_http_basic do |username, password|
          password == StripeEvent.authentication_secret
        end
      end
    end
  end
end

module StripeEvent
  class WebhookController < ActionController::Base
    if respond_to?(:before_action)
      before_action :request_authentication
    else
      before_filter :request_authentication
    end

    def event
      StripeEvent.instrument(params)
      head :ok
    rescue StripeEvent::UnauthorizedError => e
      log_error(e)
      head :unauthorized
    end

    private

    def log_error(e)
      logger.error e.message
      e.backtrace.each { |line| logger.error "  #{line}" }
    end

    def request_authentication
      if StripeEvent.authentication_secret
        authenticate_or_request_with_http_basic do |username, password|
          ActiveSupport::SecurityUtils.variable_size_secure_compare password, StripeEvent.authentication_secret
        end
      end
    end
  end
end

Use variable_size_secure_compare for HTTP auth
Use variable_size_secure_compare for HTTP auth

This change is similar to the patch for CVE-2015-7576 for Rails
5.0.0.beta1.1 and other versions.
