HMAC for webhooks

[ErikHommel]

When a webhook is received it should ideally be possible to verify the signature (HMAC) to ensure that the webhook is from the correct provider. AFAIK this also means we have to store a secret for webhook(s).

[jaapjansma]

We think we have the following possible solutions each with their own pro's and con's

1. Add validation on the CiviProx. This will check for the HMAC and validates against a CiviCRM API. So that the secret is stored in civicrm.
2. Send the whole request through. This will do not do any checks on the proxy and redirects the whole request including headers and body to CiviCRM

[ErikHommel]

To elaborate on the validation on CiviProxy: the idea is that we keep the secret from the provider on CiviCRM and create a specific API (something like Hmac check) which sends the headers and body of the request and enough information to find out which webhook needs to be verified. It returns a TRUE or FALSE, if verified the webhook is passed to CiviCRM in the way it is done today.

[jaapjansma]

For example we want to verify and receive webhooks from Vipps: https://developer.vippsmobilepay.com/docs/APIs/webhooks-api/request-authentication/#how-to-verify-a-received-request

[ErikHommel]

We started developing a CiviCRM extension that will be used by CiviProxy: https://lab.civicrm.org/extensions/civihmac