Support shared secrets for webhook authentication - Githubissues

mapbox / Hecate

Fast Geospatial Feature Storage API

MIT License

252 stars 36 forks source link

Support shared secrets for webhook authentication #186

Closed lizziegooding closed 4 years ago

lizziegooding commented 4 years ago

Context

Adds support for shared secrets to webhooks so webhook receivers can authenticate requests.

Summary of changes

[ ] add a new secret column to webhooks table where we store secrets
[ ] add the option for users to specify their own secret, otherwise generate a random string
[ ] return the secret on create; don't return the secret on all other webhook requests
[ ] add url validation to the user passed url
[ ] have webhooks send a presigned url with the hmac sha256 hashed payload and shared secret sent as a query parameter

Next steps

[ ] write tests for the send function that sends webhooks
[ ] get an initial review
[ ] support secrets in hecate UI

cc/ @ingalls @miccolis @samely @mattciferri