nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What are the authorization options for webhooks?

Fabian Huck

I have created a connection based on webhooks between a system and my Jira environment. Whenever something is created in the external system, this information is sent to Jira via a post request and also created there (automation rules).

As there are security rules I am looking for a solution to make the webhook more secure. Is it possible to create an authorization process underneath cryptographic security mechanisms. Maybe with mathematical operations?

Accepted answers

Darryl Lee

Wow this is a great question.

I am by no means a cryptographic expert, so I googled it and found this:

What are the Webhook Authentication Strategies?

I suppose you could implement a token authentication system using web requests, but it hurts my head to think about.

I think the most feasible approach would be to do some kind of Signature verification although Jira smart values for math do not unfortunately include any kind of hashing functionality.

I wonder if it would be sufficient (but certainly not completely foolproof) to do something like:

{{#=}}{{created.format("yyyyMMdd").asNumber}} + {{summary.length}} * 1337{{/}}

(Where you would choose COMPLETELY DIFFERENT fields, calculations and "salt" values)

And then on your system, you would replicate generation of that "Auth Signature" value and include it in the data payload of your webhook POST to Jira, where your Automation rule could then calculate it and see if it matches.

So I guess compare:

{{webhookData.authSignature}}

To:

{{#=}}{{webhookData.created.format("yyyyMMdd").asNumber}} * {{webhookData.summary.length}} + 1337{{/}}

Obviously with enough time, somebody could try to reverse engineer this against all the various fields and numeric values you are submitting, but I guess it would provide some peace of mind about the security of your data?

All comments

Darryl Lee

Wow this is a great question.

I am by no means a cryptographic expert, so I googled it and found this:

What are the Webhook Authentication Strategies?

I suppose you could implement a token authentication system using web requests, but it hurts my head to think about.

I think the most feasible approach would be to do some kind of Signature verification although Jira smart values for math do not unfortunately include any kind of hashing functionality.

I wonder if it would be sufficient (but certainly not completely foolproof) to do something like:

{{#=}}{{created.format("yyyyMMdd").asNumber}} + {{summary.length}} * 1337{{/}}

(Where you would choose COMPLETELY DIFFERENT fields, calculations and "salt" values)

So I guess compare:

{{webhookData.authSignature}}

To:

{{#=}}{{webhookData.created.format("yyyyMMdd").asNumber}} * {{webhookData.summary.length}} + 1337{{/}}

Fabian Huck

That's a great approach! Thank you for this..! I am going to figure it out if this works and update you! Can you answer another question to me? Another part to make this webhook secure is to define an IP whitelist. Is this possible for webhooks in Jira?

Darryl Lee

Oooh, that'd be cool to restrict your specific webhooks to an IP whitelist. But I'm guessing your webhooks like mine are hosted here:

https://automation.atlassian.com/pro/hooks/

So I'm guessing they couldn't whitelist requests to that host for just your account or rules without affecting everyone else.

Atlassian does publish their IP addresses so if you were somehow able to flip it around and have Jira make webhook calls to your service, you could whitelist Atlassian's IP Addresses .

Darryl Lee

OH - I forgot! at the Premium levels, Jira does allow IP allowlisting.

Specify IP addresses for product access

BUT since the addresses of webhooks are not site-specific (my webhooks are not automation.MYSITE.atlassian.net), this probably will not work.

If you are Premium, you should file a support ticket asking for this, and see if they can make it into a feature request.

Actually, I just searched, and oof, this isn't good:

ACCESS-1002 - Enabling allow listing policies automatically blocks Atlassian's own IPs

Darryl Lee

I'm not supposed to revive old posts (necroposting), but this came up when I was searching for a relatively NEW feature that is a much better way to implement secure webhooks vs my home-brewed solution:

From Atlassian Cloud changes Feb 26 to Mar 4, 2024:

Enhanced security for webhooks

[NEW THIS WEEK]

We’re pleased to announce an important security update for webhooks. Users now have the ability to secure webhooks with a new secret field. This enhancement applies to webhooks created through Jira Administration or via the REST API.

When a secret is added to a webhook, it is utilized to generate an HMAC (Hash-based Message Authentication Code) signature. This signature is then included in the request header, ensuring the integrity and authenticity of the webhook payload.

For a comprehensive guide on implementing and understanding this security feature, please refer to the Secure admin webhooks section in our docs.

@Fabian Huck - this is probably much better than my hackery. :-}

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-software

jira-software-cloud

webhook

automation

security