时间戳

首页 > 解决方案 > 如何在 Laravel 中正确创建签名的 webhook 结构？

php - 如何在 Laravel 中正确创建签名的 webhook 结构？

问题描述

我的应用程序（APP 1）中有一个 webhook，其中我的另一个应用程序（APP 2）需要定期命中，但是我正在考虑安全签署这些请求以确保 webhook 端点只能访问的方法通过那个应用程序。我想到了以下几点：

但是我觉得这种方法相当初级，因为如果有人掌握了这个秘密，他们将能够访问端点。应该为此使用某种公钥组合吗？有什么建议么？

标签： phplaravelwebhookssign

解决方案

If the systems are working on the same back-end or have access to the same database or similar it would be easiest to roll a new hash for every request and save it locally.

  1. APP1 generates hash and stores in file ~/secret_app_hash
  2. APP2 reads file ~/secret_app_hash and sends request with this param
  3. APP1 received HTTPS request, validates the hash against the file
  4. APP1 generates a new hash... basically back to step 1

This way the hash is never reused and only APP1 and APP2 have knowledge of the current hash value.

Another approach if the systems do not have the same back-end would be to periodically generate a new hash based on some secret that both apps knew: sha256(SECRET + current_time_window), similar to a 2-factor auth.

a side note to add would be that if you are using HTTPS and a POST request the param would not be readable for onlookers.

推荐阅读