Webhook security - Github calling a Webhook

Question

I'm looking at implementing some functionality in Runbooks, accessed via a webhook. The runbooks will be called from a HALO (ITSM) workflow, through to Github then into Azure.

I'm having problems assuring my security people that webhooks are secure (probably because they aren't). I need my Runbook to be certain that the call has come from an authorized source.

So - network solution ... I'm guessing I need some VPN-like link between Github and Azure - or something like HMAC (?).

Or code solution ... I suspect there's an Azure call I can do to generate an Azure token (maybe a timed one) from Github (or HALO) and then validate that token in my runbook. That's not an Azure Personal Access token though .. or is it? Or is HMAC the way to go?

I'm sure this has been handled before - any pointers? Thanks!

There are plenty of ways to provide assurance of the caller’s authenticity using webhooks, and to assert otherwise is ignorant at best. See GitHub’s approach. How you accomplish this will mostly vary upon the caller’s implementation of such an authentication structure, but the documentation for your ITSM of choice doesn’t make it abundantly clear at first glance if/how they support this. — esqew
– esqew, Commented May 14 at 0:19
Well, thanks for comments. I have a solution which I've posted below. My comment was that webhooks aren't secure by themselves. The caller needs to be identified in some way, manually. — Romojo
– Romojo, Commented May 19 at 3:23

Romojo · Accepted Answer · 2025-05-19 03:21:45Z

0

Came up with an answer that I believe is satisfactory, so I'm posting here. I actually used an HMAC solution, basing the hashkey on the parameters passed into the GitHub program. I run that program on a Github local runner, and start the webhook (on the same server) with the same parameters passed in, and the generated hashkey as an extra one.

The runbook behind the webhook generates its own hashkey from the same parameters, and compares it against the one passed in. If they don't match, I reject.

Hopefully this helps someone else.

answered May 19 at 3:21

Romojo

951 silver badge5 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Webhook security - Github calling a Webhook

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related