Webhook

A webhook in web development is a method of augmenting or altering the behavior of a web page or web application with custom callbacks. These callbacks may be maintained, modified, and managed by third-party users and developers who may not necessarily be affiliated with the originating website or application. The term "webhook" was coined by Jeff Lindsay in 2007 from the computer programming term hook.[1]

The format is usually JSON. The request is done as an HTTP POST request.

Function

Webhooks are "user-defined HTTP callbacks".[2] They are usually triggered by some event, such as pushing code to a repository[3] or a comment being posted to a blog.[4] When that event occurs, the source site makes an HTTP request to the URL configured for the webhook. Users can configure them to cause events on one site to invoke behavior on another.

Common uses are to trigger builds with continuous integration systems[5] or to notify bug tracking systems.[6] Because webhooks use HTTP, they can be integrated into web services without adding new infrastructure.[7]

Authenticating the webhook notification

When the client (the originating website or application) makes a webhook call to the third-party user's server, the incoming POST request should be authenticated to avoid a spoofing attack. Different techniques to authenticate the client are used:

  • The receiving endpoint can choose to keep a list of IP addresses for known sources which requests will be accepted from.
  • The webhook can include information about what type of event it is, and a secret or signature to verify the webhook.
  • An HMAC signature can be included as an HTTP header. GitHub and Stripe[9] use this technique.
  • Facebook signs their requests using SHA-1.[10]
  • Mutual TLS authentication can be used when the connection is established. The endpoint (the server) can then verify the client's certificate.[11]

See also

References
  1. Web hook to revolutionize the web, 3 May 2007, archived from the original on 2018-06-30
  2. "Webhooks". Atlassian. Retrieved 2019-09-24.]
  3. About Webhooks - Github Help
  4. WordPress Webhooks
  5. Jenkins GitHub Commit Hooks HOWTO, archived from the original on 2015-09-25
  6. Google Project Hosting - Post-Commit Web Hooks
  7. What are WebHooks and How Do They Enable a Real-time Web?
  8. "DocuSign Connect Now Includes Basic Authentication Support". DocuSign. DocuSign, Inc. Retrieved January 15, 2020. the Connect notification service has been updated to support the Basic Authentication scheme with customers’ Connect servers (listeners).
  9. "Checking Webhook Signatures". Stripe. Stripe, Inc. Retrieved 12 May 2019.
  10. "Getting Started - Graph API - Documentation - Facebook for Developers". Facebook. Facebook, Inc. Retrieved 12 May 2019.
  11. "Mutual TLS: Stuff you should know". DocuSign. DocuSign, Inc. Retrieved January 15, 2020. Mutual TLS plus Client Access Control enables your listener app to ensure that the Connect notification message was sent by DocuSign and that it wasn’t modified en route.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.