How to validate Webhook event using header.authorization

afsar.alam

I am using rest api to create a subscription in Jira https://api.atlassian.com/ex/jira/<cloudId>/rest/api/2/webhook with payload:

"url":  "My-url",

  "webhooks": [    {

      "events": [ "comment_deleted"  ],

      "jqlFilter": "project!=EMPTY",

      "excludeBody" : true  ,  

       "secret": "MySecret"

    }  ]

I am able get notification event in my My-url. In Event's header part I am getting a field authorization containing jwt token.

Can someone help me to validation that event is received from required resource?
I am using java code to validate. Can some share steps and java code if possible to validate this?

 

afsar.alam

Hi ,

Its documented that if you have created a subscription for Jira webhook using v2 version of rest api url (https://api.atlassian.com/ex/jira/<cloudId>/rest/api/2/webhook)then to authenticate received webhook event you will need your user's client secret.
https://developer.atlassian.com/cloud/jira/platform/webhooks/#registering-a-webhook-using-the-rest-api--for-connect-and-oauth-2-0-apps-

 

I used below java code snippet to validate

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
class Main{
public boolean verify(String jwtToken, String clientSecret){
claims = Jwts.parser()
.setSigningKey(clientSecret.getBytes())
.parseClaimsJws(jwtToken)
.getBody();
}
}