News for hackers. Stuff that matters.

A comment on Building Webhooks into Your Application: Guidelines and Best Practices (2020).

Re:Building Webhooks into Your Application: Guidelines and B... by alexsmolen on Tuesday March 09, 2021 @02:45PM (#26403129)
Kind of wild that there's no mention of SSRF. A quick search shows it's a pretty frequent security issue in Webhooks: https://www.google.com/search?q=ssrf+webhook
[ Parent | on HN ]
Re:Building Webhooks into Your Application: Guidelines and B... by michaelbuckbee on Tuesday March 09, 2021 @05:00PM (#26404926)
This would be a good addition: make sure that your HTTP library POSTing the webhook won't follow redirects and is blocked from accessing internal domains.
[ Parent | on HN ]