Webhook Secret not received in header

Question

Hi

The x-hub-signature header is still not being received for webhooks created via REST APIs using OAuth access tokens in Jira Cloud, even though a secret was provided. Any help or clarification on this would be greatly appreciated.

If possible, please share any official documentation that explains this behavior.

Referenced below document.

https://developer.atlassian.com/cloud/jira/platform/webhooks/#registering-a-webhook-using-the-rest-api--for-connect-and-oauth-2-0-apps-

My API : https://api.atlassian.com/ex/jira/{jira_cloud_id}/rest/api/3/webhook

Tried Payloads:

{"name": "New 1111","url":"https://webhook.site/be2e77d2-******-a637-0ea4fe61845b","webhooks": [{"events": ["jira:issue_created","jira:issue_updated"],"jqlFilter": "project = SKP","configuration":{"secret": "myZohoSecretToken999"}}]},

{"name": "New 1111","url":"https://webhook.site/be2e77d2-******-a637-0ea4fe61845b","webhooks": [{"events": ["jira:issue_created","jira:issue_updated"],"jqlFilter": "project = SKP","configuration":{"SECRET": "myZohoSecretToken999"}}]},
{"name": "New 1111","url":"https://webhook.site/be2e77d2-******-a637-0ea4fe61845b","webhooks": [{"events": ["jira:issue_created","jira:issue_updated"],"jqlFilter": "project = SKP","secret": "myZohoSecretToken999"}]},{"name": "New 1111","url":"https://webhook.site/be2e77d2-******-a637-0ea4fe61845b","webhooks": [{"events": ["jira:issue_created","jira:issue_updated"],"jqlFilter": "project = SKP","SECRET": "myZohoSecretToken999"}]}

Abiodun Oni · Answer

Took me months to find the answer, so hopefully this helps someone else. For webhooks created via REST API for oauth 2.0 apps - passing the secret is not required. The webhook payload comes with an Authorization that is signed using your oauth app client secret. literally all you have to do is check for the token, verify that the signature matches your client secret. Boom security. Simply put for webhooks created via the admin console, payloads come with X-Hub-Signature, while for webhooks created via Rest API, payloads come with Authorization token, signed with your client secret. My implementation in NestJS Injectable()export class JiraVerificationGuard implements CanActivate {private readonly logger = new Logger(JiraVerificationGuard.name);private readonly clientSecret: string; constructor(private readonly configService: ConfigService,private readonly cacheService: CacheStorageService,) {const jiraClientSecret =this.configService.get('JIRA_CLIENT_SECRET'); if (!jiraClientSecret) {this.logger.error('Jira client secret is missing');throw new BadRequestException();} this.clientSecret = jiraClientSecret;} async canActivate(context: ExecutionContext): Promise {const request = context.switchToHttp().getRequest() as RawBodyRequest; const rawBody = request.rawBody;if (!rawBody) {throw new ForbiddenException('Raw body is required for verification');} let requestBody: any;try {requestBody = JSON.parse(rawBody.toString());} catch {throw new ForbiddenException('Invalid JSON payload');} if (!requestBody) {throw new ForbiddenException('Missing webhook payload');} const authorization = request.headers.authorization;if (!authorization) {throw new ForbiddenException('Missing authorization header');} const [scheme, token] = authorization.split(' ');if (scheme !== 'Bearer' || !token) {throw new ForbiddenException('Invalid authorization header');} let payload: JwtPayload;try {payload = jwt.verify(token, this.clientSecret, {algorithms: ['HS256', 'HS512'],}) as JwtPayload;} catch (error) {this.logger.warn('Invalid Jira webhook token signature', { error });throw new ForbiddenException('Invalid webhook token');} this.validateClaims(payload);await this.enforceReplayProtection(payload); return true;} private validateClaims(payload: JwtPayload): void {} private async enforceReplayProtection(payload: JwtPayload): Promise {}

Chitra Nagdeo · Answer

Hey @Anand Elumalai

Welcome to Atlassian community!

I will recommend you to reach below team to help you with this issue.

Atlassian Developer and Marketplace support : https://developer.atlassian.com/support

Atlassian Developer Community: https://community.developer.atlassian.com/

Regards
Chitra Nagdeo