Security & validation
To ensure the security of your integration with Orq.ai, it is crucial to verify that all webhook requests originate from Orq.ai. This involves validating the webhook signatures to prevent unauthorized access and manipulation.
Webhook validation
For signature verification, it is essential to use the raw body of the request. If you are using a framework, ensure that it does not alter the raw body, as any manipulation will cause the verification process to fail.
Key Points
- Raw Body Requirement: Ensure the raw body of the request is used for verification. Avoid any transformations by your framework that might alter it.
- Signature Header: The signature is retrieved from the X-Orq-Signature header.
- Exception Handling: Implement exception handling to manage invalid request bodies and signature verification failures.
import express, { Request, Response } from 'express';
import { WebhookEvent, WebhookEventType } from '@orq-ai/node';
const app = express();
const port = 3000;
const webhookSecret = 'orq_wk_...';
app.post('/webhooks', (req: Request, res: Response) => {
const signature = req.headers['x-orq-signature'] as string;
const rawBody = req.body;
let event: WebhookEvent;
try {
const requestBody = JSON.parse(rawBody.toString());
event = client.webhooks.constructEvent(
requestBody,
signature,
webhookSecret
);
switch (event.type) {
case WebhookEventType.DeploymentInvoked:
console.log('Deployment invoked:', event.data);
}
res.json({ received: true });
} catch (err) {
console.error('Error validating webhook event:', e);
return res.status(400).send(`Webhook Error: ${e.message}`);
}
});
app.listen(port, () => {
console.log(`Server running at http://localhost:${port}`);
});
from fastapi import Request, FastAPI
import orq_ai_sdk.exceptions
webhook_secret = 'orq_wk_...'
app = FastAPI()
@app.post("/webhooks")
async def get_body(request: Request):
request_body = await request.json()
signature = request.headers.get("X-Orq-Signature")
event = None
try:
event = client.webhooks.construct_event(
request_body,
signature,
webhook_secret
)
except ValueError as e:
# Invalid request body
print('Error parsing payload: {}'.format(str(e)))
except orq_ai_sdk.exceptions.SignatureVerificationException as e:
# Invalid signature
print('Error verifying webhook signature: {}'.format(str(e)))
if event['type'] == 'deployment.invoked':
from orq_ai_sdk.api_resources.webhooks import WebhookDeploymentInvokedEvent
invoked_event = WebhookDeploymentInvokedEvent.model_validate(event['data'])
print('Deployment invoked: {}'.format(invoked_event))
By following these steps, you can effectively secure your webhooks and ensure that only authentic requests from Orq.ai are processed.
Updated 2 months ago