[
https://issues.apache.org/jira/browse/CAMEL-26281?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26281 started by Claus Ibsen.
-------------------------------------------
> camel-whatsapp - verify the webhook event signature by default
> --------------------------------------------------------------
>
> Key: CAMEL-26281
> URL: https://issues.apache.org/jira/browse/CAMEL-26281
> Project: Camel
> Issue Type: Improvement
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> The WhatsApp webhook consumer ({{webhook:whatsapp:...}}) can check the
> {{X-Hub-Signature-256}} header of inbound event callbacks against the app
> secret (option {{webhookSecret}}, added in CAMEL-23762). Today the check runs
> only when {{webhookSecret}} is set; when it is not set, every POST to the
> webhook path is routed as an event. This change makes the check the default,
> in line with the camel-openai webhook consumer.
> h3. Behaviour today
> * {{webhookSecret}} is optional and has no default. Without it,
> {{WhatsAppWebhookProcessor}} routes every event callback without checking
> {{X-Hub-Signature-256}}.
> * The webhook examples in the component documentation do not set
> {{webhookSecret}}.
> * After the route has processed an event callback, the HTTP reply carries the
> request body back.
> h3. Behaviour after the change
> * A new boolean option {{webhookSignatureVerification}} (default {{true}},
> label {{security}}) on {{WhatsAppConfiguration}}. It is marked {{security =
> "insecure:dev"}} with {{insecureValue = "false"}}, so the {{prod}} profile
> reports it when it is turned off.
> * With verification on, a {{webhook:whatsapp:}} route without
> {{webhookSecret}} fails to start, with a message that names both options.
> * With verification on, an event callback without a valid
> {{X-Hub-Signature-256}} is answered with HTTP 403 and is not routed.
> * With verification off ({{webhookSignatureVerification=false}}, intended for
> development), events are routed without the check and a WARN is logged once
> at startup.
> * An event callback is answered with HTTP 200 and an empty body. The GET
> subscription handshake still returns {{hub.challenge}}.
> h3. Code changes
> * {{WhatsAppConfiguration}}: add {{webhookSignatureVerification}}; rewrite
> the {{webhookSecret}} description (required for webhook mode unless
> verification is turned off); align the {{webhookPath}} {{defaultValue}}
> annotation with the field value {{camel-whatsapp/webhook}}.
> * {{WhatsAppEndpoint.createWebhookHandler}}: throw
> {{IllegalArgumentException}} when verification is on and {{webhookSecret}} is
> empty.
> * {{WhatsAppWebhookProcessor}}: verify every event POST when verification is
> on; log the WARN when it is off; clear the reply body after the route has run
> for an event POST. Coordinate with CAMEL-26164, which changes the same method.
> * {{whatsapp-component.adoc}}: set {{webhookSecret}} in the Java and YAML
> webhook examples and describe the verification and the
> {{webhookSignatureVerification}} option.
> * Regenerate the component JSON, configurer, endpoint DSL and catalog.
> * Upgrade guide entry in {{camel-4x-upgrade-guide-4_24.adoc}}: webhook events
> are verified by default; a {{webhook:whatsapp:}} route now needs
> {{webhookSecret}} (the app secret from the Meta app dashboard) or
> {{webhookSignatureVerification=false}}.
> h3. Tests
> * {{webhookRouteWithoutSecretFailsToStart}}
> * {{eventWithoutSignatureIsRejectedWith403AndNotRouted}}
> * {{eventWithValidSignatureIsRouted}}
> * {{eventIsRoutedWithoutSignatureWhenVerificationIsDisabled}}
> * {{eventReplyHasEmptyBody}}
> * {{WhatsAppWebhookTest}} updated to set {{webhookSecret}} and sign its
> request.
> h3. Backports
> Planned for camel-4.22.x and camel-4.18.x, with an upgrade guide entry for
> each line; whether a route without {{webhookSecret}} fails to start there or
> only logs a WARN is decided per line. On camel-4.18.x the new option cannot
> carry the {{insecure:dev}} marking.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
