DocuSign: HMAC security for webhook endpoint

[shaun-technovation]

Right now the webhook endpoint built in #4691 is a public endpoint, available to anyone. We should lock-down this endpoint so only DocuSign can use it.

From the documentation:

Once HMAC is enabled, special header values will be included in your Connect messages that you can use to verify:

• That the message was sent by DocuSign Connect (authenticity).
• That the message contents are exactly the same as they were at the time of sending (integrity).

• [x] Setup MHAC secrets and integration in DocuSign
• [x] Manually verify a payload using HMAC
• [x] Setup Pagekite to test webhooks locally
• [x] Create generic service to verify any webhook payload using HMAC
• [x] Integrate verification service into DocuSign webhook flow

[dboyer]

Hey team! Please add your planning poker estimate with Zenhub @shaun-technovation @viviancan

[shaun-technovation]

A few notes/links related to the work I did:

Documentation on creating and setting up the HMAC secret key in DocuSign:

• https://developers.docusign.com/platform/webhooks/connect/setting-up-hmac/

A blogpost from DocuSign on manually verifying a payload with HMAC:

• https://www.docusign.com/blog/developers/manually-authenticating-hmac-signatures-docusign-connect-webhook-configurations

Documentation and code examples (including Ruby) on verifying a payload with HMAC:

• https://developers.docusign.com/platform/webhooks/connect/validate/

I also setup Pagekite locally to test all of this:

• https://pagekite.net/

[shaun-technovation]

This is on Preview. Everything should work as expected, like it is now.

The behind the scenes changes are that now when we receive a webhook payload it will get verified with our secret key (that only DocuSign and we have), if it's valid everything will happen that's happening now (the legal document will get marked as signed). If the payload is not valid, we'll log an error message, and then basically nothing will happen. This makes is so that only verified payloads from DocuSign (who has the secret key) will get processed.

[dboyer]

I was able to sign documents on preview and I see the signed stamp on the admin side