How do you add custom HTTP headers to a webhook?

[Matthew Adams]

I'm trying to mirror a bitbucket repo to gitlab and need to add a custom header, PRIVATE-TOKEN, containing my gitlab access token, in order to invoke gitlab's mirror pull API:  https://gitlab.com/help/api/projects.md#start-the-pull-mirroring-process-for-a-project-starter.

There's no option for it in the webhook creation dialog.  How can I do that?

-matthew

[Dario B · Accepted solution]

Hi @Matthew Adams ,

Welcome to the Atlassian Community!

Even if there is no possibility at the moment to add custom headers to Bitbucket Webhooks, the way to send authenticated WebHooks to Gitlab seems to be described in the below documentation page (from Gitlab):

• Using GitLab CI/CD with a Bitbucket Cloud repository

  1. In GitLab create a CI/CD for external repo, select Repo by URL and create the project.

     

     GitLab will import the repository and enable Pull Mirroring.
     
     

  2. In GitLab create a Personal Access Token with api scope. This will be used to authenticate requests from the web hook that will be created in Bitbucket to notify GitLab of new commits.
     
     

  3. In Bitbucket, from Settings > Webhooks, create a new web hook to notify GitLab of new commits.

     The web hook URL should be set to the GitLab API to trigger pull mirroring, using the Personal Access Token we just generated for authentication.

     https://gitlab.com/api/v4/projects/<PROJECT_ID>/mirror/pull?private_token=<PERSONAL_ACCESS_TOKEN>
     

     The web hook Trigger should be set to ‘Repository Push’.

     4. [....]

Together with the above one, you may want to also review below liks:

• Integrate your GitLab server with Bitbucket Cloud
• Repository Mirroring
• Oauth on Bitbucket Cloud

For the rest, it might be worth also mentioning that:

1. Two way integration can also be achieved by using the add-on: "Sync Bitbucket with GitLab"
2. There are the below feature requests open in our system that you may want to vote for, and watch for updates:
   • BCLOUD-14683 - Add webhook secret
   • BCLOUD-16271 - Ability to add secret fields to webhooks

I hope this helps.

Cheers,
Dario

[Matthew Adams]

Hi @Dario B

Thanks for the suggestion.  Adding the query string argument `private_token` to the gitlab url actually worked.  Thanks!

-matthew

[Matthew Adams]

There is a compromise in this solution:  the GitLab token is viewable in clear text by anyone who can see the project settings.

I'll see if I can chime in on the issues linked herein.

[Wolfgang Maurer]

Honestly, custom headers are such an obvious feature, that is missing from webhooks.