It would be great to have the ability to authenticate the webhook requests so that they can't be triggered by undesirable 3rd parties.

CommentFileSizeAuthor
#2 webhook_validator.tar_.gz768 bytesfp
#2 webhook.module-validator-2330651.patch1.04 KBfp

Comments

fp’s picture

fp commented
Title: Authenticating webhook requests » Authenticating / validating webhook requests
fp’s picture

fp commented
StatusFileSize
new webhook.module-validator-2330651.patch1.04 KB
new webhook_validator.tar_.gz768 bytes

Here's a proof of concept. Please let me know your feedback.

skwashd’s picture

skwashd commented
Status: Active » Needs work

I will have to think about this.

Webhooks are supposed to be stateless, so I am not in favour of adding support for authentication. If you want to implement HTTP Basic Authentication to restrict access to the webhook endpoint/s then do it higher up the stack in your web server or cache server config.

GitHub and some other services implement a pre shared key, so you can check for the key in the processor. This is how I currently validate requests where this is potentially an issue.

I found a couple of issues with your patch too. I haven't looked at your webhook_validator module.

  1. +++ b/modules/contrib/webhook/webhook.module
@@ -93,9 +93,26 @@ function webhook_process_request($name) {
+  ¶

    Trailing whitespace. 

  2. +++ b/modules/contrib/webhook/webhook.module
@@ -93,9 +93,26 @@ function webhook_process_request($name) {
+      drupal_add_http_header('Status', '403 Access Denied');

    Use drupal_access_denied() here.

skwashd’s picture

skwashd commented
Status: Needs work » Closed (won't fix)

No update for 8 years. Closing.