Only accept post requests to the webhook endpoint.
Verify Stripe sent the webhook, use the ID sent in the webhook and request the event from the Stripe API directly.