Inweb development, awebhook is a method of augmenting or altering the behavior of aweb page orweb application with customcallbacks. These callbacks may be maintained, modified, and managed by third-party users who need not be affiliated with the originating website or application. In 2007,Jeff Lindsay coined the termwebhook from the computer programming termhook.[1]
Webhooks are "user-defined HTTP callbacks".[2] They are usually triggered by some event, such as pushing code to a repository,[3] a purchase, a comment being posted to a blog[4] and many more use cases.[5] When that event occurs, the source site makes an HTTP request to the URL configured for the webhook. Users can configure them to cause events on one site to invoke behavior on another.
Common uses are to trigger builds withcontinuous integration systems[6] or to notifybug tracking systems.[7] Because webhooks use HTTP, they can be integrated into web services without adding new infrastructure.[8]
When the client (the originating website or application) makes a webhook call to the third-party user's server, the incoming POST request should be authenticated to avoid aspoofing attack and its timestamp verified to avoid areplay attack.[9] Different techniques to authenticate the client are used:
The sender may choose to keep a constant list ofIP addresses from which requests will be sent. This is not a sufficient security measure on its own, but it is useful for when the receiving endpoint is behind afirewall orNAT.
Another potential security hole is what's called replay attacks.
the Connect notification service has been updated to support the Basic Authentication scheme with customers' Connect servers (listeners).
Mutual TLS plus Client Access Control enables your listener app to ensure that the Connect notification message was sent by DocuSign and that it wasn't modified en route.