Contents

Webhook

Function[edit]

Webhooks are "user-defined HTTP callbacks".^[2] They are usually triggered by some event, such as pushing code to a repository,^[3] a comment being posted to a blog^[4] and many more use cases.^[5] When that event occurs, the source site makes an HTTP request to the URL configured for the webhook. Users can configure them to cause events on one site to invoke behavior on another.

Common uses are to trigger builds with continuous integration systems^[6] or to notify bug tracking systems.^[7] Because webhooks use HTTP, they can be integrated into web services without adding new infrastructure.^[8]

Authenticating the webhook notification[edit]

When the client (the originating website or application) makes a webhook call to the third-party user's server, the incoming POST request should be authenticated to avoid a spoofing attack and its timestamp verified to avoid a replay attack.^[9] Different techniques to authenticate the client are used:

• HTTP basic authentication can be used to authenticate the client.^[10]

• The webhook can include information about what type of event it is, and a shared secretordigital signature to verify the webhook.

• AnHMAC signature can be included as a HTTP header. GitHub,^[11] Stripe^[12] and Facebook^[13] use this technique.

• Mutual TLS authentication can be used when the connection is established. The endpoint (the server) can then verify the client's certificate.^[14]

The sender may choose to keep a constant list of IP addresses from which requests will be sent. This is not a sufficient security measure on its own, but it is useful for when the receiving endpoint is behind a firewallorNAT.

See also[edit]

• Application programming interface
• Open API
• Mashup (web application hybrid)

References[edit]

External links[edit]

• Working with Webhooks