Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hash function for webhook obfuscation #1161

Open
analystcmyk opened this issue Apr 1, 2024 · 0 comments
Open

Hash function for webhook obfuscation #1161

analystcmyk opened this issue Apr 1, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@analystcmyk
Copy link

analystcmyk commented Apr 1, 2024

I am sending channel values to a webhook handler with sendget, like

sendget http://webhook.site/...?C2=$CH2&C3=$CH3

Now on the server side (understanding we cannot use TLS due to memory issues) I would like to do some kind of check that it is a valid request.

Although not foolproof, a hash function might help :

// for inspection
setChannelType 16 readonly
setChannelLabel 16  "Hash"

// set the hash value (example)
setChannel 16 hash $CH2+$CH3+970857320753905;

// send the hash value together with the data
sendget http://webhook.site/...?C2=$CH2&C3=$CH3&hash=$CH16

In this way at the webhook handler knowing the 'secret' 970857320753905 we can check the hash and if it matches, store the channel values. If not, we reject the request.

This is definitely no security, but at least it would not be trivial any more to dump fake data into the webhook handler.

Having a known hash like md5 would ease the serverside validation.

Question : is there a hash function available that could we can consider to use in script?

@analystcmyk analystcmyk changed the title hash function for webhook obfuscation Hash function for webhook obfuscation Apr 1, 2024
@openshwprojects openshwprojects added the enhancement New feature or request label Apr 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants