search

aldinokemal / go-whatsapp-web-multidevice

API for Whatsapp Web Multi Device Version, Support UI & Webhook
MIT License
492 stars 216 forks source link

add webhook secret option #187

Closed mr687 closed 2 weeks ago

mr687 commented 2 weeks ago

Context

https://github.com/aldinokemal/go-whatsapp-web-multidevice/issues/184

  1. Add new option --webhook-secret="super-secret-key"
  2. Every webhook will send extra header X-Hub-Signature-256: sha256={signature} to the target client
  3. Client will verify the signature

Example Usage

  1. Start whatsapp service for example using docker.

    docker run --detach \
--publish=3000:3000 \
--name=whatsapp \
--restart=always \
--volume=$(docker volume create --name=whatsapp):/app/storages \
aldinokemal2104/go-whatsapp-web-multidevice \
--webhook="http://yourwebhook.site/webhook/whatsapp" \
--webhook-secret="super-secret-key"

  2. Example webhook content:

    // Headers
{
"X-Hub-Signature-256": "sha256=1790a93ec78e7d0294884cd983c063756f8a068c53b1123600d0fe8678f7c830",
"Content-Type": "application/json",
"Lontent-Length": "406",
"User-Agent": "Go-http-client/1.1",
...
}
// Body
{
  "audio": null,
  "contact": null,
  "document": null,
  "forwarded": false,
  "from": "xxx@s.whatsapp.net in xxxx@s.whatsapp.net",
  "image": null,
  ....
}
  1. Verify webhook signature. 
    
const crypto = require('node:crypto')
const express = require('express')

const app = express() const secretKey = "super-secret-key"

app.post("/webhook/whatsapp", async (req, res) => { const signature = req.headers['X-Hub-Signature-256'] || "" const body = req.body

const expectedHash = crypto.createHmac("sha256", secretKey) .update(JSON.stringify(body)) .digest("hex") const actualHash = signature.slice("sha256=".length) const isValidSignature = expectedHash === actualHash

if (!isValidSignature) { throw new BadRequestException('Signature invalid!'); }

// DOING SOMETHING GREAT...

return res.send("ok") })

coderabbitai[bot] commented 2 weeks ago

Walkthrough

The pull request introduces enhancements for securing webhook communications in the application. It adds a command-line flag --webhook-secret for users to specify a secret key, updates configuration settings with a new global variable WhatsappWebhookSecret, and implements a function to generate HMAC signatures for validating webhook requests. These changes aim to improve the security and integrity of interactions with WhatsApp webhooks.

Changes

File Change Summary
src/cmd/root.go Added a persistent flag --webhook-secret for configuring a webhook secret.
src/config/settings.go Introduced a global variable WhatsappWebhookSecret to store the webhook secret.
src/pkg/whatsapp/whatsapp.go Added a function getMessageDigestOrSignature to generate HMAC SHA-256 signatures for outgoing webhook requests.

Possibly related issues

🐰 In the garden of code, I hop with glee,
A secret for webhooks, just for thee!
With signatures strong, our messages secure,
The whispers of safety, forever endure.
So let’s dance with joy, in this digital spree,
For every new change, brings harmony! 🌼✨

[!TIP]

OpenAI O1 model for chat - We have deployed OpenAI's latest O1 model for chat. - OpenAI claims that this model has superior reasoning capabilities than their GPT-4o model. - Please share any feedback with us in the [discussions post](https://discord.com/channels/1134356397673414807/1283929536186155099).
Recent review details **Configuration used: CodeRabbit UI** **Review profile: CHILL**
Commits Files that changed from the base of the PR and between 4bc94db25d9d25a3b1c9cde4104471b9a1e8d89d and 25903a89b03f3fa02fc9d261178c5423dbab5b31.
Files selected for processing (2) * src/config/settings.go (1 hunks) * src/pkg/whatsapp/whatsapp.go (3 hunks)
Files skipped from review as they are similar to previous changes (2) * src/config/settings.go * src/pkg/whatsapp/whatsapp.go
--- Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
Share - [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)
Tips ### Chat There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai): - Review comments: Directly reply to a review comment made by CodeRabbit. Example: - `I pushed a fix in commit .` - `Generate unit testing code for this file.` - `Open a follow-up GitHub issue for this discussion.` - Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples: - `@coderabbitai generate unit testing code for this file.` - `@coderabbitai modularize this function.` - PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples: - `@coderabbitai generate interesting stats about this repository and render them as a table.` - `@coderabbitai show all the console.log statements in this repository.` - `@coderabbitai read src/utils.ts and generate unit testing code.` - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.` - `@coderabbitai help me debug CodeRabbit configuration file.` Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. ### CodeRabbit Commands (Invoked using PR comments) - `@coderabbitai pause` to pause the reviews on a PR. - `@coderabbitai resume` to resume the paused reviews. - `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository. - `@coderabbitai full review` to do a full review from scratch and review all the files again. - `@coderabbitai summary` to regenerate the summary of the PR. - `@coderabbitai resolve` resolve all the CodeRabbit review comments. - `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository. - `@coderabbitai help` to get help. ### Other keywords and placeholders - Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed. - Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description. - Add `@coderabbitai` anywhere in the PR title to generate the title automatically. ### CodeRabbit Configuration File (`.coderabbit.yaml`) - You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository. - Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information. - If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json` ### Documentation and Community - Visit our [Documentation](https://coderabbit.ai/docs) for detailed information on how to use CodeRabbit. - Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback. - Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.
mr687 commented 2 weeks ago

Hi bang @aldinokemal, can you please approve this PR as I need this webhook secret for my project. thanks.

mr687 commented 2 weeks ago

Thank for your efforts for providing HMAC into webhook header, just left some comment Could you provided webhook capture?

Oh I missed that, okay I’ve updated the description.