Class WebhookVerifier

java.lang.Object

com.kingsrook.qqq.backend.core.utils.webhooks.WebhookVerifier

public final class WebhookVerifier
extends Object

Verifies a signed webhook request (Standard Webhooks format, see WebhookSigner).

Checks, in order: the three headers are present, the timestamp is within the tolerance of now (default five minutes, either direction, which stops replays of old requests), and at least one v1 signature matches one of the receiver's secrets. Comparison is constant time. Unknown signature versions are ignored, so a future scheme can be added alongside v1.

Receivers should also remember recent webhook-ids and ignore a repeat: the same id is sent again on every retry of the same event.

Field Summary

Fields

Modifier and Type	Field	Description
static final Duration	DEFAULT_TOLERANCE

Constructor Summary

Constructors

Constructor	Description
WebhookVerifier(List<WebhookSecret> secrets)	Verifier with the default tolerance and the system clock.
WebhookVerifier(List<WebhookSecret> secrets, Duration tolerance, Clock clock)	Verifier.

Method Summary

Modifier and Type	Method	Description
void	verify(Map<String,String> headers, byte[] body)	Verify a request.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_TOLERANCE

public static final Duration DEFAULT_TOLERANCE

Constructor Details

WebhookVerifier

public WebhookVerifier(List<WebhookSecret> secrets)

Verifier with the default tolerance and the system clock.

WebhookVerifier

public WebhookVerifier(List<WebhookSecret> secrets,
 Duration tolerance,
 Clock clock)

Verifier.

Method Details

verify

public void verify(Map<String,String> headers,
 byte[] body)
            throws WebhookVerificationException

Verify a request. Header names are matched case-insensitively.

Throws:

WebhookVerificationException - with a reason safe to log