I think is worth considering to adopt the same strategy GitHub uses to secure web-hooks. This strategy is much more secure that passing an none encrypted key. For more documentation please take a look at this https://developer.github.com/webhooks/securing. Here is some example code that shows how to validate the request you could also implement a middle-ware using this approach:

export let validateGithubRequest = ({ secret, req }) => {
  let signature = req.headers['x-hub-signature']
  let hmac = createHmac('sha1', secret)
  let body = Buffer.from(req.rawBody)
  hmac.update(body, 'utf-8')
  return signature === `sha1=${hmac.digest('hex')}`
}
.
.
.
let preserveRawBody = (req, res, bodyBuffer) => {
  req.rawBody = bodyBuffer.toString('utf8')
}

.
.
.
  const app = express(feathers())
  app
    .configure(express.rest(rest()))
    .configure(socketio())
    .configure(prometheus)
    .use(bodyParser.json({ limit: '50mb', verify: preserveRawBody }))
.
.
.

@keyvan-m-sadeghi Let me know what you think and I can implement a PR that exemplifies what I'm proposing.

How to secure the rest endpoint #58

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions