Configuring Your Outbound Webhook Requests with Static IPs(getconvoy.io)
getconvoy.io
Configuring Your Outbound Webhook Requests with Static IPs
https://getconvoy.io/blog/configuring-your-outbound-webhook-requests-with-static-ips/
4 comments
Convoy author here.
We also provide Signature verification. Static IPs are added security mechanisms for webhook consumers with strict network access rules.
We also provide Signature verification. Static IPs are added security mechanisms for webhook consumers with strict network access rules.
> You should validate that the request is signed correctly
I agree with you here, but wondering what you see the benefit of per-app PKI is, versus signing all webhooks with the same cert. Is it to prevent having to do a key rotation that would impact every webhook consumer?
I agree with you here, but wondering what you see the benefit of per-app PKI is, versus signing all webhooks with the same cert. Is it to prevent having to do a key rotation that would impact every webhook consumer?
If you specify one public key for all endpoints, It means all consumers can verify each other’s webhook data which is not what you want. You want each consumer to be able to verify only webhooks intended for them and fail otherwise.
We wrote a detailed guide on generating and rolling public key/secrets for your endpoints here [1]
[1] https://getconvoy.io/blog/generating-stripe-like-webhook-sig...
We wrote a detailed guide on generating and rolling public key/secrets for your endpoints here [1]
[1] https://getconvoy.io/blog/generating-stripe-like-webhook-sig...
You should validate that the request is signed correctly, and reject it if not. An IP ACL can be a useful "remove some of the noise" tool, but no more than that.
For example, Discord's webhook implementation has you verify the incoming request against an app-specific (your app; not all apps) public key: https://discord.com/developers/docs/interactions/receiving-a... — this is really the right approach to this.