Learn how to set up Webhooks and receive Server Events with OutRival.
Webhooks in the OutRival app allow for real-time notifications about specific events within the application. By providing a Webhook URL and a Webhook Secret, you can configure the OutRival app to call your specified URL during certain events. This enables your application to react and handle updates as they happen.
To set up webhooks, you need to provide two pieces of information:
Webhook URL: The endpoint URL to which the notifications should be sent.
Webhook Secret: A secret key used to generate a signature for each payload, ensuring the security and integrity of the data being transmitted.
When an event occurs, the OutRival app generates a POST request to the provided Webhook URL. The payload of this request contains information about the event, and the x-signature header contains a signature generated from the payload using the Webhook Secret. This signature must be used to verify that the request is indeed from OutRival.
The payload of the webhook is structured as follows:
To ensure the security of the webhook mechanism, it is crucial to verify the x-signature header in each incoming request. This signature is generated by hashing the payload with the Webhook Secret. Your endpoint should compute the hash with the received payload and the secret you provided when setting up the webhook. If the computed hash matches the x-signature header, the request can be considered authentic and from OutRival.
Here are a few examples of how to verify the signature in different programming languages:
Copy
const express = require('express'); const crypto = require('crypto');const app = express();app.use(express.raw({ type: "*/*", limit: "10mb" })); // Set the encoding for express.raw()app.post('/your-webhook-endpoint', (req, res) => {const payload = req.body.toString("utf-8");const secret = 'your_shared_secret';const xSignature = req.headers['x-signature']; const generatedSignature = crypto.createHmac("sha256", secret).update(payload).digest("hex"); if (generatedSignature === xSignature) { console.log('Signature is valid.'); res.status(200).send('Signature verified'); } else { console.log('Signature is invalid.'); res.status(403).send('Invalid signature'); }});app.listen(3000, () => console.log('Server running on port 3000'));
Copy
const express = require('express'); const crypto = require('crypto');const app = express();app.use(express.raw({ type: "*/*", limit: "10mb" })); // Set the encoding for express.raw()app.post('/your-webhook-endpoint', (req, res) => {const payload = req.body.toString("utf-8");const secret = 'your_shared_secret';const xSignature = req.headers['x-signature']; const generatedSignature = crypto.createHmac("sha256", secret).update(payload).digest("hex"); if (generatedSignature === xSignature) { console.log('Signature is valid.'); res.status(200).send('Signature verified'); } else { console.log('Signature is invalid.'); res.status(403).send('Invalid signature'); }});app.listen(3000, () => console.log('Server running on port 3000'));
using Microsoft.AspNetCore.Builder;using Microsoft.AspNetCore.Http;using System;using System.IO;using System.Security.Cryptography;using System.Text;using System.Threading.Tasks;public class VerifySignatureMiddleware{private readonly RequestDelegate \_next; public VerifySignatureMiddleware(RequestDelegate next) { _next = next; } public async Task InvokeAsync(HttpContext context) { var secret = Encoding.UTF8.GetBytes("your_shared_secret"); var payload = await new StreamReader(context.Request.Body).ReadToEndAsync(); context.Request.Body.Position = 0; // Reset the stream for further reading var xSignature = context.Request.Headers["X-Signature"].ToString(); using var hmac = new HMACSHA256(secret); var computedSignature = BitConverter.ToString(hmac.ComputeHash(Encoding.UTF8.GetBytes(payload))).Replace("-", "").ToLower(); if (computedSignature.Equals(xSignature, StringComparison.OrdinalIgnoreCase)) { await _next(context); } else { context.Response.StatusCode = 403; await context.Response.WriteAsync("Invalid signature"); } }}// Extension method used to add the middleware to the HTTP request pipeline.public static class VerifySignatureMiddlewareExtensions{public static IApplicationBuilder UseVerifySignatureMiddleware(this IApplicationBuilder builder){return builder.UseMiddleware<VerifySignatureMiddleware>();}}
To use this middleware, add it to your application’s request pipeline in the Startup.cs file:
Copy
public void Configure(IApplicationBuilder app, IWebHostEnvironment env){ // Other configurations... app.UseVerifySignatureMiddleware(); // Further configurations...}