yookassa/docs/changelog.md

Changelog

2026-03-02

Added

• Rails engine integration for webhook handling (Yookassa::Engine).
• Default webhook controller (Yookassa::WebhooksController) with built-in authenticity checks.
• Config options for webhook security:
  • webhook_token (secret URL token in path)
  • webhook_allowed_ips (YooKassa source allowlist, overridable)
• RSpec coverage for webhook controller behavior.
• Cuprite browser spec for real browser webhook request flow.
• CI job for browser tests in GitHub Actions.

Changed

• Documentation updated to use gem-based webhook integration instead of app-side hand-rolled service/controller code.
• Webhook security guidance switched to YooKassa-documented approach:
  • secret URL token
  • source IP allowlist
  • API re-fetch and object/status comparison

Notes

• No webhook signature header validation is implemented because YooKassa webhook docs describe authenticity checks via source IP and object status verification.
• Source for default IP ranges: https://yookassa.ru/developers/using-api/webhooks#ip