Took me months to find the answer, so hopefully this helps someone else.
For webhooks created via REST API for oauth 2.0 apps - passing the secret is not required.
The webhook payload comes with an Authorization <token> that is signed using your oauth app client secret. literally all you have to do is check for the token, verify that the signature matches your client secret. Boom security.
Simply put for webhooks created via the admin console, payloads come with X-Hub-Signature, while for webhooks created via Rest API, payloads come with Authorization token, signed with your client secret. My implementation in NestJS
@Injectable()
export class JiraVerificationGuard implements CanActivate {
private readonly logger = new Logger(JiraVerificationGuard.name);
private readonly clientSecret: string;
constructor(
private readonly configService: ConfigService,
private readonly cacheService: CacheStorageService,
) {
const jiraClientSecret =
this.configService.get<string>('JIRA_CLIENT_SECRET');
if (!jiraClientSecret) {
this.logger.error('Jira client secret is missing');
throw new BadRequestException();
}
this.clientSecret = jiraClientSecret;
}
async canActivate(context: ExecutionContext): Promise<boolean> {
const request = context
.switchToHttp()
.getRequest() as RawBodyRequest<Request>;
const rawBody = request.rawBody;
if (!rawBody) {
throw new ForbiddenException('Raw body is required for verification');
}
let requestBody: any;
try {
requestBody = JSON.parse(rawBody.toString());
} catch {
throw new ForbiddenException('Invalid JSON payload');
}
if (!requestBody) {
throw new ForbiddenException('Missing webhook payload');
}
const authorization = request.headers.authorization;
if (!authorization) {
throw new ForbiddenException('Missing authorization header');
}
const [scheme, token] = authorization.split(' ');
if (scheme !== 'Bearer' || !token) {
throw new ForbiddenException('Invalid authorization header');
}
let payload: JwtPayload;
try {
payload = jwt.verify(token, this.clientSecret, {
algorithms: ['HS256', 'HS512'],
}) as JwtPayload;
} catch (error) {
this.logger.warn('Invalid Jira webhook token signature', { error });
throw new ForbiddenException('Invalid webhook token');
}
this.validateClaims(payload);
await this.enforceReplayProtection(payload);
return true;
}
private validateClaims(payload: JwtPayload): void {}
private async enforceReplayProtection(payload: JwtPayload): Promise<void> {}
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.