What are Webhooks and why they’re not secure
The growth of Webhooks has been substantial over the last couple of years and more and more services are offering the ability to configure them. In a nutshell, a Webhook’s purpose is to notify you when some sort of event occurs. If you want to use a Webhook, you need to provide a callback URL, and the service offering the Webhook will make a HTTP request to that URL whenever the specified event occurs. All you need is the ability to listen for HTTP requests to the callback URL. The sad part is that standard HTTP messages are insecure and can be easily spoofed, and this could potentially open up a security hole when using Webhooks.
What are Secure Webhooks?
Once your server is configured to receive requests, it’ll listen for any requests sent to the endpoint you configured. For security purposes, you would want to limit requests to those coming from a trusted source. This can be accomplished by implementing an authentication mechanism for all Webhooks sent via the source. However, there is a trade-off between convenience and complexity. The down-side of this approach is that it introduces more complexity for the recipient of the Webhook – they need to be able to calculate what the hash value should be. But hey better safe than sorry, right?
Why you need Secure Webhooks
For instance, let’s say you’re an online vendor who uses Stripe as the payment provider. Stripe offers multiple Webhooks, but let’s talk about the one that informs you when someone has made a purchase. This information can be used to dispatch the product to the buyer. This example highlights the importance of a security mechanism for Webhooks. Imagine what the implications would be if a fake Webhook was received by the system. You don’t want anyone to be able to call your Webhook and get free items shipped to them – we need to be able to verify who the Webhook is from.
Next Steps
Security is a key element that should be considered in every component of a web application. By default, a Webhook URL is publicly accessible and can receive a payload from anybody who knows the URL. Secure Webhooks are best-suited for organisations that exchange sensitive data in real-time via Webhooks and thus, require an additional level of security. It ensures information is coming in from verified sources and therefore, protects unwanted data from entering the system. To find out more on the different ways of implementing secure Webhooks, read the third part over here.
