[
https://issues.apache.org/jira/browse/CAMEL-26281?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-26281:
--------------------------------
Description:
The WhatsApp webhook consumer ({{webhook:whatsapp:...}}) can check the
{{X-Hub-Signature-256}} header of inbound event callbacks against the app
secret (option {{webhookSecret}}, added in CAMEL-23762). Today the check runs
only when {{webhookSecret}} is set; when it is not set, every POST to the
webhook path is routed as an event. This change makes the check the default, in
line with the camel-openai webhook consumer.
h3. Behaviour today
* {{webhookSecret}} is optional and has no default. Without it,
{{WhatsAppWebhookProcessor}} routes every event callback without checking
{{X-Hub-Signature-256}}.
* The webhook examples in the component documentation do not set
{{webhookSecret}}.
* After the route has processed an event callback, the HTTP reply carries the
request body back.
h3. Behaviour after the change
* A new boolean option {{webhookSignatureVerification}} (default {{true}},
label {{security}}) on {{WhatsAppConfiguration}}. It is marked {{security =
"insecure:dev"}} with {{insecureValue = "false"}}, so the {{prod}} profile
reports it when it is turned off.
* With verification on, a {{webhook:whatsapp:}} route without {{webhookSecret}}
fails to start, with a message that names both options.
* With verification on, an event callback without a valid
{{X-Hub-Signature-256}} is answered with HTTP 403 and is not routed.
* With verification off ({{webhookSignatureVerification=false}}, intended for
development), events are routed without the check and a WARN is logged once at
startup.
* An event callback is answered with HTTP 200 and an empty body. The GET
subscription handshake still returns {{hub.challenge}}.
h3. Code changes
* {{WhatsAppConfiguration}}: add {{webhookSignatureVerification}}; rewrite the
{{webhookSecret}} description (required for webhook mode unless verification is
turned off); align the {{webhookPath}} {{defaultValue}} annotation with the
field value {{camel-whatsapp/webhook}}.
* {{WhatsAppEndpoint.createWebhookHandler}}: throw {{IllegalArgumentException}}
when verification is on and {{webhookSecret}} is empty.
* {{WhatsAppWebhookProcessor}}: verify every event POST when verification is
on; log the WARN when it is off; clear the reply body after the route has run
for an event POST. Coordinate with CAMEL-26164, which changes the same method.
* {{whatsapp-component.adoc}}: set {{webhookSecret}} in the Java and YAML
webhook examples and describe the verification and the
{{webhookSignatureVerification}} option.
* Regenerate the component JSON, configurer, endpoint DSL and catalog.
* Upgrade guide entry in {{camel-4x-upgrade-guide-4_24.adoc}}: webhook events
are verified by default; a {{webhook:whatsapp:}} route now needs
{{webhookSecret}} (the app secret from the Meta app dashboard) or
{{webhookSignatureVerification=false}}.
h3. Tests
* {{webhookRouteWithoutSecretFailsToStart}}
* {{eventWithoutSignatureIsRejectedWith403AndNotRouted}}
* {{eventWithValidSignatureIsRouted}}
* {{eventIsRoutedWithoutSignatureWhenVerificationIsDisabled}}
* {{eventReplyHasEmptyBody}}
* {{WhatsAppWebhookTest}} updated to set {{webhookSecret}} and sign its request.
h3. Backports
Planned for camel-4.22.x and camel-4.18.x, with an upgrade guide entry for each
line; as on main, a webhook route without {{webhookSecret}} (and without
{{webhookVerification=false}}) fails to start there too. On camel-4.18.x the
new option cannot carry the {{insecure:dev}} marking.
was:
The WhatsApp webhook consumer ({{webhook:whatsapp:...}}) can check the
{{X-Hub-Signature-256}} header of inbound event callbacks against the app
secret (option {{webhookSecret}}, added in CAMEL-23762). Today the check runs
only when {{webhookSecret}} is set; when it is not set, every POST to the
webhook path is routed as an event. This change makes the check the default, in
line with the camel-openai webhook consumer.
h3. Behaviour today
* {{webhookSecret}} is optional and has no default. Without it,
{{WhatsAppWebhookProcessor}} routes every event callback without checking
{{X-Hub-Signature-256}}.
* The webhook examples in the component documentation do not set
{{webhookSecret}}.
* After the route has processed an event callback, the HTTP reply carries the
request body back.
h3. Behaviour after the change
* A new boolean option {{webhookSignatureVerification}} (default {{true}},
label {{security}}) on {{WhatsAppConfiguration}}. It is marked {{security =
"insecure:dev"}} with {{insecureValue = "false"}}, so the {{prod}} profile
reports it when it is turned off.
* With verification on, a {{webhook:whatsapp:}} route without {{webhookSecret}}
fails to start, with a message that names both options.
* With verification on, an event callback without a valid
{{X-Hub-Signature-256}} is answered with HTTP 403 and is not routed.
* With verification off ({{webhookSignatureVerification=false}}, intended for
development), events are routed without the check and a WARN is logged once at
startup.
* An event callback is answered with HTTP 200 and an empty body. The GET
subscription handshake still returns {{hub.challenge}}.
h3. Code changes
* {{WhatsAppConfiguration}}: add {{webhookSignatureVerification}}; rewrite the
{{webhookSecret}} description (required for webhook mode unless verification is
turned off); align the {{webhookPath}} {{defaultValue}} annotation with the
field value {{camel-whatsapp/webhook}}.
* {{WhatsAppEndpoint.createWebhookHandler}}: throw {{IllegalArgumentException}}
when verification is on and {{webhookSecret}} is empty.
* {{WhatsAppWebhookProcessor}}: verify every event POST when verification is
on; log the WARN when it is off; clear the reply body after the route has run
for an event POST. Coordinate with CAMEL-26164, which changes the same method.
* {{whatsapp-component.adoc}}: set {{webhookSecret}} in the Java and YAML
webhook examples and describe the verification and the
{{webhookSignatureVerification}} option.
* Regenerate the component JSON, configurer, endpoint DSL and catalog.
* Upgrade guide entry in {{camel-4x-upgrade-guide-4_24.adoc}}: webhook events
are verified by default; a {{webhook:whatsapp:}} route now needs
{{webhookSecret}} (the app secret from the Meta app dashboard) or
{{webhookSignatureVerification=false}}.
h3. Tests
* {{webhookRouteWithoutSecretFailsToStart}}
* {{eventWithoutSignatureIsRejectedWith403AndNotRouted}}
* {{eventWithValidSignatureIsRouted}}
* {{eventIsRoutedWithoutSignatureWhenVerificationIsDisabled}}
* {{eventReplyHasEmptyBody}}
* {{WhatsAppWebhookTest}} updated to set {{webhookSecret}} and sign its request.
h3. Backports
Planned for camel-4.22.x and camel-4.18.x, with an upgrade guide entry for each
line; whether a route without {{webhookSecret}} fails to start there or only
logs a WARN is decided per line. On camel-4.18.x the new option cannot carry
the {{insecure:dev}} marking.
> camel-whatsapp - verify the webhook event signature by default
> --------------------------------------------------------------
>
> Key: CAMEL-26281
> URL: https://issues.apache.org/jira/browse/CAMEL-26281
> Project: Camel
> Issue Type: Improvement
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> The WhatsApp webhook consumer ({{webhook:whatsapp:...}}) can check the
> {{X-Hub-Signature-256}} header of inbound event callbacks against the app
> secret (option {{webhookSecret}}, added in CAMEL-23762). Today the check runs
> only when {{webhookSecret}} is set; when it is not set, every POST to the
> webhook path is routed as an event. This change makes the check the default,
> in line with the camel-openai webhook consumer.
> h3. Behaviour today
> * {{webhookSecret}} is optional and has no default. Without it,
> {{WhatsAppWebhookProcessor}} routes every event callback without checking
> {{X-Hub-Signature-256}}.
> * The webhook examples in the component documentation do not set
> {{webhookSecret}}.
> * After the route has processed an event callback, the HTTP reply carries the
> request body back.
> h3. Behaviour after the change
> * A new boolean option {{webhookSignatureVerification}} (default {{true}},
> label {{security}}) on {{WhatsAppConfiguration}}. It is marked {{security =
> "insecure:dev"}} with {{insecureValue = "false"}}, so the {{prod}} profile
> reports it when it is turned off.
> * With verification on, a {{webhook:whatsapp:}} route without
> {{webhookSecret}} fails to start, with a message that names both options.
> * With verification on, an event callback without a valid
> {{X-Hub-Signature-256}} is answered with HTTP 403 and is not routed.
> * With verification off ({{webhookSignatureVerification=false}}, intended for
> development), events are routed without the check and a WARN is logged once
> at startup.
> * An event callback is answered with HTTP 200 and an empty body. The GET
> subscription handshake still returns {{hub.challenge}}.
> h3. Code changes
> * {{WhatsAppConfiguration}}: add {{webhookSignatureVerification}}; rewrite
> the {{webhookSecret}} description (required for webhook mode unless
> verification is turned off); align the {{webhookPath}} {{defaultValue}}
> annotation with the field value {{camel-whatsapp/webhook}}.
> * {{WhatsAppEndpoint.createWebhookHandler}}: throw
> {{IllegalArgumentException}} when verification is on and {{webhookSecret}} is
> empty.
> * {{WhatsAppWebhookProcessor}}: verify every event POST when verification is
> on; log the WARN when it is off; clear the reply body after the route has run
> for an event POST. Coordinate with CAMEL-26164, which changes the same method.
> * {{whatsapp-component.adoc}}: set {{webhookSecret}} in the Java and YAML
> webhook examples and describe the verification and the
> {{webhookSignatureVerification}} option.
> * Regenerate the component JSON, configurer, endpoint DSL and catalog.
> * Upgrade guide entry in {{camel-4x-upgrade-guide-4_24.adoc}}: webhook events
> are verified by default; a {{webhook:whatsapp:}} route now needs
> {{webhookSecret}} (the app secret from the Meta app dashboard) or
> {{webhookSignatureVerification=false}}.
> h3. Tests
> * {{webhookRouteWithoutSecretFailsToStart}}
> * {{eventWithoutSignatureIsRejectedWith403AndNotRouted}}
> * {{eventWithValidSignatureIsRouted}}
> * {{eventIsRoutedWithoutSignatureWhenVerificationIsDisabled}}
> * {{eventReplyHasEmptyBody}}
> * {{WhatsAppWebhookTest}} updated to set {{webhookSecret}} and sign its
> request.
> h3. Backports
> Planned for camel-4.22.x and camel-4.18.x, with an upgrade guide entry for
> each line; as on main, a webhook route without {{webhookSecret}} (and without
> {{webhookVerification=false}}) fails to start there too. On camel-4.18.x the
> new option cannot carry the {{insecure:dev}} marking.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
