Webhooks in Nettalk?

[AtoB]

Hi All,

I'm about to add webhook functionality to my api-server (so I'm the consumer in this case).

- is there any functionality already in place with Nettalk (14), maybe some examples in the example apps?
- is it good practice to implement HMAC validation and can I do this with Nettalk?
- is there any standard that is actual standard (I see quite different implementations all over the place ...)?

TIA,

regards,
Ton

[osquiabro]

well i have a webhook for listener stripe transaction, telegram and Alexa, is a simple netwebservicemethod

[AtoB]

Do  you have HMAC validation in place?

I don't have to interface with a relatively '"standard" provider, but I'm trying to design a webhook system so relatively small B2B partners have to follow "my" standard, that's why I want to setup it properly in advance ...

[rjolda]

Hi,
HMAC is a method in Capesoft Cryptonite. Using it regularly in my NT Web App. I am using it to validate the Text that I place in a QR code when the QR code is created.  When the user displays the QR code to the reader, we calculate the HMAC of the string read from the QR code to make certain it has not been tampered with.  wouldn't be without it!
Ron

[AtoB]

Hi all,

the thing is: what is good practice? For example I see the following implementations of the HMAC string to validate:

- messageId.timestamp.body (looks most sensible to me ...)
- timestamp.body
- variants without dots ...

Even how the labels of the http-headers are constructed seem to vary ("webhook-timestamp" seems most common)

I was hoping Nettalk maybe had this already under the hood.

B.t.w. currently out of office and running to the shop buying Cryptonite ...

Regards,
Ton

[AtoB]

Been working on this (quite a bit of work actually), but for anyone interested, I think this is a really good resource : https://webhooker.eu/blog.

Also there are services that (like this webhooker) take care of the pesky details

[rjolda]

HI Ton,
Very interesting article.  Perhaps you might want to share how you use webhooks in NetTalk and why.
Thanks,
Ron

[AtoB]

Hi Ron,

why: I need to interface (API) with a new transportation system for one of my clients that plans and keeps track of trips/shipments/etc from various parties. This system (by default) sends out lots of data (to our already heavily used api-servers). Their payloads are quite large and most are not necessary for us. We decided a webhook system would be better. Now they just signal to our api-server: trip X has changed or shipment Y has updates and then we just register these events. They send really small payloads and I respond in a couple of milliseconds.

I've got a separate application that processes these webhook events and decides wether they are relevant for our needs (and when they are I fetch the data from their system and process it). Main advantage: I can skip lots of events and always retrieve the most current data/state from this system.

The api-server has (currently) one endpoint (basicly NetWebmethod) that registers the events. It's not entirely finished and needs some polishing on my end but it adheres to some standards and the article prevented me from making stupid mistakes (which there probably are still some in this system :-))

When it's stable I can post some code snippets so you can get the gist of it if you like to (currently working on the event processing bit and still making changes ...)

Regards,
Ton

[rjolda]

Hi Ton,
Thanks for explaining - makes a lot of sense and I see your need.
Ron