Esri / Esri/webhooks-samples

Javascript sample incorrectly reads `x-esrihook-signature` from HTTP headers instead of `x-www-form-urlencoded` encoded webhook body

Open
#38 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
94
Forks
28
PR merge metrics
No merged PRs in 30d

Description

The [documentation for webhooks](https://developers.arcgis.com/rest/services-reference/online/web-hooks-security-feature-service/#example-usage-immediate-webhook-confirmation) has a Security section which says:

> If the secret key is specified for a webhook, all feature server payload calls to the receiver will contains a signature hash value. The signature starts with sha256= and uses the receiver secret key to compute the hash of the webhook payload body.
>
> Below is an example of the response header:
>
> x-esriHook-Signature = "sha256=x0mYd8hz2goCTfcNAaMqENy2BFgJJfJOb4PdvTffpwg="

The Javascript webhook handler example implements this:

https://github.com/Esri/webhooks-samples/blob/cae894a4dfe8fe7b48ed8fa541fe812a8ff12407/Developer/typescript/node.js/src/app.ts#L63-L64

but in production, Esri's webhook servers send `x-esriHook-Signature` not as an HTTP header, but as a parameter of the POST body (by default, in `x-www-form-urlencoded` encoding).

Better, but still problematic since it doesn't really implement `x-www-form-urlencoded` decoding, is the Python example, which searches the `POST` body for `x-esriHook-Signature=` and extracts the value the decodes it:

https://github.com/Esri/webhooks-samples/blob/cae894a4dfe8fe7b48ed8fa541fe812a8ff12407/sample-workflows/azure-write-table/Hook/__init__.py#L96-L99

Contributor guide

Open the contributing guide

Research direction

Start with Developer/typescript/node.js/src/app.ts around lines 63-64 and sample-workflows/azure-write-table/Hook/__init__.py around lines 96-99. Compare both examples with the documented x-www-form-urlencoded webhook body and verify how the signature is extracted. Done means the samples handle x-esriHook-Signature from the encoded POST body rather than assuming an HTTP header or searching the raw body.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, python, typescript
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.