Claus Ibsen created CAMEL-26281:
-----------------------------------
Summary: camel-whatsapp - verify the webhook event signature by
default
Key: CAMEL-26281
URL: https://issues.apache.org/jira/browse/CAMEL-26281
Project: Camel
Issue Type: Improvement
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0, 4.22.3, 4.18.6
The WhatsApp webhook consumer ({{webhook:whatsapp:...}}) can check the
{{X-Hub-Signature-256}} header of inbound event callbacks against the app
secret (option {{webhookSecret}}, added in CAMEL-23762). Today the check runs
only when {{webhookSecret}} is set; when it is not set, every POST to the
webhook path is routed as an event. This change makes the check the default, in
line with the camel-openai webhook consumer.
h3. Behaviour today
* {{webhookSecret}} is optional and has no default. Without it,
{{WhatsAppWebhookProcessor}} routes every event callback without checking
{{X-Hub-Signature-256}}.
* The webhook examples in the component documentation do not set
{{webhookSecret}}.
* After the route has processed an event callback, the HTTP reply carries the
request body back.
h3. Behaviour after the change
* A new boolean option {{webhookSignatureVerification}} (default {{true}},
label {{security}}) on {{WhatsAppConfiguration}}. It is marked {{security =
"insecure:dev"}} with {{insecureValue = "false"}}, so the {{prod}} profile
reports it when it is turned off.
* With verification on, a {{webhook:whatsapp:}} route without {{webhookSecret}}
fails to start, with a message that names both options.
* With verification on, an event callback without a valid
{{X-Hub-Signature-256}} is answered with HTTP 403 and is not routed.
* With verification off ({{webhookSignatureVerification=false}}, intended for
development), events are routed without the check and a WARN is logged once at
startup.
* An event callback is answered with HTTP 200 and an empty body. The GET
subscription handshake still returns {{hub.challenge}}.
h3. Code changes
* {{WhatsAppConfiguration}}: add {{webhookSignatureVerification}}; rewrite the
{{webhookSecret}} description (required for webhook mode unless verification is
turned off); align the {{webhookPath}} {{defaultValue}} annotation with the
field value {{camel-whatsapp/webhook}}.
* {{WhatsAppEndpoint.createWebhookHandler}}: throw {{IllegalArgumentException}}
when verification is on and {{webhookSecret}} is empty.
* {{WhatsAppWebhookProcessor}}: verify every event POST when verification is
on; log the WARN when it is off; clear the reply body after the route has run
for an event POST. Coordinate with CAMEL-26164, which changes the same method.
* {{whatsapp-component.adoc}}: set {{webhookSecret}} in the Java and YAML
webhook examples and describe the verification and the
{{webhookSignatureVerification}} option.
* Regenerate the component JSON, configurer, endpoint DSL and catalog.
* Upgrade guide entry in {{camel-4x-upgrade-guide-4_24.adoc}}: webhook events
are verified by default; a {{webhook:whatsapp:}} route now needs
{{webhookSecret}} (the app secret from the Meta app dashboard) or
{{webhookSignatureVerification=false}}.
h3. Tests
* {{webhookRouteWithoutSecretFailsToStart}}
* {{eventWithoutSignatureIsRejectedWith403AndNotRouted}}
* {{eventWithValidSignatureIsRouted}}
* {{eventIsRoutedWithoutSignatureWhenVerificationIsDisabled}}
* {{eventReplyHasEmptyBody}}
* {{WhatsAppWebhookTest}} updated to set {{webhookSecret}} and sign its request.
h3. Backports
Planned for camel-4.22.x and camel-4.18.x, with an upgrade guide entry for each
line; whether a route without {{webhookSecret}} fails to start there or only
logs a WARN is decided per line. On camel-4.18.x the new option cannot carry
the {{insecure:dev}} marking.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
