Building Webhooks into Your Application: Guidelines and Best Practices (2020)

Re:Building Webhooks into Your Application: Guidelines and B... by mrkurt on Tuesday March 09, 2021 @02:57PM (#26403321)

SSRF is a tremendous problem with webhooks. Stripe also solves this: https://fly.io/blog/practical-smokescreen-sanitizing-your-ou...

[ Parent | on HN ]

Re:Building Webhooks into Your Application: Guidelines and B... by grinich on Tuesday March 09, 2021 @03:04PM (#26403421)

Agreed, I should add something on this. (Haven't updated the article since posting it many months ago.)

[ Parent | on HN ]

Re:Building Webhooks into Your Application: Guidelines and B... by alexsmolen on Tuesday March 09, 2021 @04:53PM (#26404850)

This is a pretty good article about preventing SSRF including DNS rebinding-based attacks in Go https://www.agwa.name/blog/post/preventing_server_side_reque...

[ Parent | on HN ]

Re:Building Webhooks into Your Application: Guidelines and B... by tasn on Tuesday March 09, 2021 @04:06PM (#26404262)

Yeah, it's one of the thing that people miss when implementing webhooks naively, and I bet it's one of the things people miss when consuming them!

[ Parent | on HN ]