5 ms·
I've only ever leaked a webhook, realised minutes later, and then changed the webhook URL on the backend. It's not hard to do, and doing anything else is simply
by libeclipse 10y ago
I've only ever leaked a webhook, realised minutes later, and then changed the webhook URL on the backend. It's not hard to do, and doing anything else is simply really crappy security through obscurity while hoping for the best.
- thecrazyone 10y agoWhy would a webhook URL be a secret? Wouldn't it be more like internal API if anything? I would assume that the parameters sent to the webhook, an auth token or something of the sort would take care of the security bit. Obscuring the URL seems like security-by-obscurity no?
- ksenzee 10y agoFor purposes of security, there's no difference between example.com/api/my-webhook?auth-token=[some-uuid] and example.com/api/my-webhook/[some-uuid].
- olalonde 10y agoNot if you treat the secret URL like a password. Plus, not all webhook callers allow you to authenticate them without supplying them a special URL.