Webhook security? about chatwoot HOT 4 OPEN

This is a known missing feature, see #4732

Currently the only option is to use a webhook url that is not guessable, e.g. by using a random string in the url or as a query parameter. Not ideal, but slightly better than just using a url like /webhook/chatwoot

from chatwoot.

PR-1075 Webhook security?

from chatwoot.

For additional reference, GitHub themselves have HMAC-digest-based webhook payload verification: https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries

I believe Meta Webhooks are the same mechanism, as are countless other platforms that offer Webhook functionality.

Perhaps good to align with this practice unless I'm blind and have overlooked something?

from chatwoot.

Querystring key passing: I've used exactly that in my project. Thanks for mentioning that as an expected mitigation!

from chatwoot.