Improve webhook security

veda-consulting-company / uk.co.vedaconsulting.mailchimp

Other

22 stars 43 forks source link

Closed michaelmcandrew closed 6 years ago

michaelmcandrew commented 7 years ago

A couple of ways that we can improve the usability and security of the mailchimp webhook part of this extension:

remove the webhook permission
require and automatically generate a random secret key on the CiviCRM side for the webhook (users shouldn't have to make up a long unguessable string)

I'm interested to hear thoughts on this.

deepak-srivastava commented 6 years ago

See #292 (v2.0.1). Secret key is now auto generated. Permission not removed, but user is informed about it's state.

veda-consulting commented 6 years ago

Closing