implement secure webhook delivery pipeline with retries - #388
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implemented a complete webhook notification system to replace the previous placeholder implementation, enabling secure, reliable, and auditable event delivery to external integrations.
The update introduces persistent webhook subscription and delivery models in Prisma, allowing applications to register, manage, and monitor webhook endpoints. The dispatch pipeline now automatically discovers active subscriptions, signs every outgoing payload using HMAC-SHA256, and delivers events through authenticated HTTP POST requests.
To improve reliability, the worker includes configurable retry logic with exponential backoff for transient failures while avoiding retries for client-side errors. Failed deliveries are recorded for auditing, and subscriptions are automatically deactivated after repeated unsuccessful attempts to prevent unnecessary processing.
Security was strengthened by validating webhook registration requests to reject insecure HTTP endpoints, localhost addresses, loopback interfaces, and private network IP ranges, reducing SSRF attack risks.
Management endpoints were added for registering, listing, and deactivating webhook subscriptions, providing a complete lifecycle for webhook administration. Comprehensive integration tests were also implemented to verify successful signed deliveries, retry behavior, subscription deactivation, SSRF protection, and overall delivery reliability.
Key Improvements
Implemented production-ready webhook dispatch pipeline.
Added Prisma models and migrations for webhook subscriptions and delivery history.
Signed webhook payloads using HMAC-SHA256 for request authentication.
Added exponential backoff retry logic for transient failures.
Prevented retries on non-recoverable client errors.
Automatically deactivated subscriptions after repeated delivery failures.
Added secure webhook management endpoints (register, list, deactivate).
Implemented SSRF protection by rejecting insecure and private network endpoints.
Added integration tests covering delivery, retries, signing, failure handling, and security validation.
Improved observability with persistent delivery logs and webhook lifecycle tracking.
Closes #375