GF Stripe Payment Flow Audit

Four payment flows traced across Stripe 5.9.2, 6.0.3 and 7.0.0-rc.2, plus the findings ledger

The Spine

Webhooks are REQUIRED as of Stripe 7, for every payment path on this add-on.

Each flow document carries that same statement, then states its own exception: the Card Element reached webhook dependence early, at 6.0.3. The Payment Element defers it to 7.0.0-rc.2. Stripe Checkout was already webhook dependent in 5.9.2 and did not move at all. The core document traces the Gravity Forms plumbing underneath all three.

Start with a flow document to see what the code does; go to the findings ledger to see what should change. Every document has a version switcher, expandable nodes, a triage layer, and text-size and theme controls that persist across the whole site.

Recommendations

Findings ledger

Findings: 5.9.2 to 7.0.0-rc.2

54 de-duplicated findings drawn from 87 across the four passes, ordered worst-for-support first, each with its ledger ID and file:line citations. Missing logging, filters that no longer fire, payment state write points, and everything else.

4 categories54 findingssource: findings.md

Flow documents

Stripe add-on · Flow 1

Stripe Card Element

stripe_elements with multiple payment methods off. Webhook dependent from 6.0.3: the entry saves first with no payment status, browser AJAX confirms with Stripe, and the webhook is the only writer of the final Paid / Active / Failed state.

5.9.2 · 6.0.3 · 7.0.0-rc.2source: ledger-card-element.md

Stripe add-on · Flow 2

Stripe Payment Element

stripe_elements with multiple payment methods on. Classic draft-and-redirect on 5.9.2 and 6.0.3 — money moves before an entry exists — then joins the entry-first, AJAX-then-webhook architecture at 7.0.0-rc.2.

5.9.2 · 6.0.3 · 7.0.0-rc.2source: ledger-payment-element.md

Stripe add-on · Flow 3

Stripe Checkout

The stripe_checkout plugin setting. The only path whose architecture did not move between 5.9.2 and 7.0.0-rc.2: session created, entry saved and marked Processing, customer pays offsite, and final state comes from whichever leg wins — browser return or webhook.

byte-identical across versionssource: ledger-checkout.md

Gravity Forms core · Flow 4

Core Payment Flow

Different in kind: no Stripe version at all. The GF core plumbing every Stripe document cites by CORE- claim id — the synchronous request pipeline, the callback skeleton, two payment holding tables, eleven entry state writers, and the transactionType branch point.

GF 2.10.5 · 3.0.2source: ledger-core.md

Documents produced by a Fable audit pass over the payment flow code; analysis and verification of the findings is still in progress, so treat the ordering and severity framing as a triage starting point rather than a settled ranking. Content is reproduced as authored — only navigation and the findings ledger's web formatting were added.