Reverse webhook authentication
The disclosure generally describes one or more techniques for authenticating a webhook endpoint with a webhook server. Some techniques include a webhook server sending a seed with a webhook endpoint after the webhook endpoint is registered with the webhook server. In some examples, the webhook server generates the seed to send to the webhook endpoint and stores the seed with a key associated with the webhook endpoint. In such examples, the webhook server does not send data associated with the particular events to the webhook endpoint until the webhook endpoint acknowledges receipt of the seed while the seed is still valid.
1. A method for authenticating one or more webhook endpoints, comprising:
sending, by a server, a first blocking authentication event including a first seed and an expiry timestamp to a webhook endpoint;
prior to expiration of a predetermined time period based on the expiry timestamp, receiving by the server, a first acknowledgement response from the webhook endpoint, wherein the first acknowledgement response includes the first seed and a key;
in response to receiving the first acknowledgment response, authenticating, by the server, the webhook endpoint;
generating, by the server, a second seed;
sending, by the server, a first event with the second seed to the webhook endpoint; and
receiving, by the server, a second acknowledgment response from the webhook endpoint, wherein the second acknowledgement response includes the second seed and the key.
2. The method of claim 1 , further comprising:
generating, by the server, a third seed;
sending, by the server, a second authentication event including the third seed and the expiry timestamp to the webhook endpoint; and
in response to receiving a third acknowledgement response including the first or the third seed, authenticating, by the server, the webhook endpoint.
3. The method of claim 1 , further comprising:
before receiving, by the server, the first acknowledgement response from the webhook endpoint, forgoing sending the first event.
4. The method of claim 1 , wherein:
the first seed has a first amount of time before expiration,
the second seed has a second amount of time before expiration that is more than the first amount of time before expiration, and
the first event with the second seed is sent to the webhook endpoint before the first amount of time before expiration is less than or equal to zero.
5. The method of claim 1 , further comprising:
while the webhook endpoint is authenticated by the server, receiving, by the server, a third acknowledgment response that includes the second seed and the key; and
in response to determining that the second seed is invalid:
initiating a process to re-authenticate the webhook endpoint with the server; and
blocking one or more events that have occurred until the webhook endpoint is re-authenticated with the server.
6. The method of claim 5 , further comprising:
while blocking the one or more events, removing, by the server, a respective set of events from the one or more events, wherein a delivery period for each of the respective set of events has expired.
7. The method of claim 1 , wherein the key corresponds to the webhook endpoint.
8. The method of claim 1 , wherein the webhook endpoint is authenticated based on receiving an acknowledgement response with a valid seed and the key.
9. A non-transitory computer-readable storage medium storing one or more programs configured to be executed by one or more processors of a server, the one or more programs including instructions for:
sending, by the server, a first blocking authentication event including a first seed and an expiry timestamp to a webhook endpoint;
prior to expiration of a predetermined time period based on the expiry timestamp, receiving, by the server, a first acknowledgement response from the webhook endpoint, wherein the first acknowledgement response is associated with the first seed and a client key;
in response to receiving the first acknowledgment response, authenticating, by the server, the webhook endpoint;
generating, by the server, a second seed;
sending, by the server, a first event with the second seed to the webhook endpoint; and
receiving, by the server, a second acknowledgment response from the webhook endpoint, wherein the second acknowledgement response is associated with the second seed and the client key.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the one or more programs further include instructions for:
generating, by the server, a third seed;
sending, by the server, a second authentication event including the third seed and the expiry timestamp to the webhook endpoint; and
in response to receiving a third acknowledgement response associated the first or the third seed, authenticating, by the server, the webhook endpoint.
11. The non-transitory computer-readable storage medium of claim 9 , wherein the one or more programs further include instructions for:
before receiving, by the server, the first acknowledgement response from the webhook endpoint, forgoing sending the first event.
12. The non-transitory computer-readable storage medium of claim 9 , wherein:
the first seed has a first amount of time before expiration,
the second seed has a second amount of time before expiration that is more than the first amount of time before expiration, and
the first event with the second seed is sent to the webhook endpoint before the first amount of time before expiration is less than or equal to zero.
13. The non-transitory computer-readable storage medium of claim 9 , wherein the one or more programs further include instructions for:
while the webhook endpoint is authenticated by the server, receiving, by the server, a third acknowledgment response that is associated with the second seed and the client key; and
in response to determining that the second seed is invalid:
initiating a process to re-authenticate the webhook endpoint with the server; and
blocking one or more events that have occurred until the webhook endpoint is re-authenticated with the server.
14. The non-transitory computer-readable storage medium of claim 13 , for wherein the one or more programs further include instructions for:
while blocking the one or more events, removing, by the server, a respective set of events from the one or more events, wherein a delivery period for each of the respective set of events has expired.
15. A computer system, comprising:
one or more processors; and
memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for:
sending, by a server, a first blocking authentication event including a first seed and an expiry timestamp to a webhook endpoint associated with a client;
prior to expiration of a predetermined time period based on the expiry timestamp, receiving, by the server, a first acknowledgement response from the webhook endpoint, wherein the first acknowledgement response is associated with the first seed and an endpoint key;
in response to receiving the first acknowledgment response, authenticating, by the server, the webhook endpoint;
generating, by the server, a second seed;
sending, by the server, a first event with the second seed to the webhook endpoint; and
receiving, by the server, a second acknowledgment response from the webhook endpoint, wherein the second acknowledgement response is associated with the second seed and the endpoint key.
16. The computer system of claim 15 , wherein the one or more programs further include instructions for:
generating, by the server, a third seed;
sending, by the server, a second authentication event including the third seed and the expiry timestamp to the webhook endpoint; and
in response to receiving a third acknowledgement response associated with the first or the third seed, authenticating, by the server, the webhook endpoint.
17. The computer system of claim 15 , wherein the one or more programs further include instructions for:
prior to receiving, by the server, the first acknowledgement response from the webhook endpoint, forgoing sending the first event.
18. The computer system of claim 15 , wherein:
the first seed has a first amount of time before expiration,
the second seed has a second amount of time before expiration that is more than the first amount of time before expiration, and
the first event with the second seed is sent to the webhook endpoint before the first amount of time before expiration is less than or equal to zero.
19. The computer system of claim 15 , wherein the one or more programs further include instructions for:
receiving, by the server, a third acknowledgment response that is associated with the second seed and the endpoint key; and
in response to determining that the second seed is invalid:
initiating a process to re-authenticate the webhook endpoint with the server; and
blocking one or more events received by the server until the webhook endpoint is authenticated with the server.
20. The computer system of claim 19 , wherein the one or more programs further include instructions for:
while blocking the one or more events, removing, by the server, a respective set of events from the one or more events, wherein a delivery period for each of the respective set of events has expired.