0

Applications like GitHub.com and GitLab.com can trigger webhook calls once something in issues change. In these examples you can set up a webhook or integration and register some secret. At the receiving endpoint of the webhook, the headers of the webhook HTTP POST request contain information about the originating service and the nature of the trigger... and that secret as well (or, in GitHub's case, a SHA-1 hash over the payload computed using that secret).

In either way, you can test whether the webhook API request is valid - coming from a system that you know and accept requests from. Since the webhook API endpoint is 'open' by nature, an attacker could otherwise forge requests that you couldn't distinguish from authenticated calls.

I've investigated Jira's webhook API requests, and tried to find similar functionality in the documentation... but with no luck yet. Question: how can Jira webhook calls be authenticated so that a receiving endpoint can distinguish between valid and fake requests? Can request headers contain data to signal a) that it's coming from an issue change in Jira, and b) a secret or token to test the request's validity?

@moderator: could you add a 'webhooks' tag? I'm just lacking the reputation for that in this StackExchange.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.