Javascript sample incorrectly reads `x-esrihook-signature` from HTTP headers instead of `x-www-form-urlencoded` encoded webhook body
- Dominant language
- Python
- Stars
- 94
- Forks
- 28
- PR merge metrics
- No merged PRs in 30d
Description
The [documentation for webhooks](https://developers.arcgis.com/rest/services-reference/online/web-hooks-security-feature-service/#example-usage-immediate-webhook-confirmation) has a Security section which says:
> If the secret key is specified for a webhook, all feature server payload calls to the receiver will contains a signature hash value. The signature starts with sha256= and uses the receiver secret key to compute the hash of the webhook payload body.
>
> Below is an example of the response header:
>
> x-esriHook-Signature = "sha256=x0mYd8hz2goCTfcNAaMqENy2BFgJJfJOb4PdvTffpwg="
The Javascript webhook handler example implements this:
https://github.com/Esri/webhooks-samples/blob/cae894a4dfe8fe7b48ed8fa541fe812a8ff12407/Developer/typescript/node.js/src/app.ts#L63-L64
but in production, Esri's webhook servers send `x-esriHook-Signature` not as an HTTP header, but as a parameter of the POST body (by default, in `x-www-form-urlencoded` encoding).
Better, but still problematic since it doesn't really implement `x-www-form-urlencoded` decoding, is the Python example, which searches the `POST` body for `x-esriHook-Signature=` and extracts the value the decodes it:
https://github.com/Esri/webhooks-samples/blob/cae894a4dfe8fe7b48ed8fa541fe812a8ff12407/sample-workflows/azure-write-table/Hook/__init__.py#L96-L99
Contributor guide
Research direction
Start with Developer/typescript/node.js/src/app.ts around lines 63-64 and sample-workflows/azure-write-table/Hook/__init__.py around lines 96-99. Compare both examples with the documented x-www-form-urlencoded webhook body and verify how the signature is extracted. Done means the samples handle x-esriHook-Signature from the encoded POST body rather than assuming an HTTP header or searching the raw body.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, python, typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100