Affected by 
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var AllowPrivateIPs bool
AllowPrivateIPs controls whether webhook URLs may resolve to reserved/private IP addresses. When true, the SSRF protection is disabled. This is useful for self-hosted deployments where webhooks target services on the local network.
Functions ¶
func GenerateSigningSecret ¶ added in v0.30.0
GenerateSigningSecret returns a new Standard Webhooks signing secret in the "whsec_<base64>" form, backed by 32 cryptographically-random bytes — comfortably within the spec's 24–64 byte range.
func Post ¶
func Post(requestPayload *WebhookRequestPayload) error
Post posts the message to webhook endpoint.
func PostAsync ¶
func PostAsync(requestPayload *WebhookRequestPayload)
PostAsync posts the message to webhook endpoint asynchronously. It enqueues the request for bounded asynchronous dispatch and does not wait for the response.
func ValidateSigningSecret ¶ added in v0.30.0
ValidateSigningSecret checks that secret is either empty (allowed) or contains only printable ASCII characters (0x20–0x7E), excluding all control characters such as \r and \n, which would corrupt the webhook signature headers. When the secret uses the Standard Webhooks "whsec_<base64>" serialization, the base64 body must decode cleanly so signing cannot silently fall back to the wrong key.
func ValidateURL ¶
ValidateURL checks that rawURL:
- Parses as a valid absolute URL.
- Uses the http or https scheme.
- Does not resolve to a reserved/private IP address.
It returns a gRPC InvalidArgument status error so callers can return it directly.
Types ¶
type WebhookRequestPayload ¶
type WebhookRequestPayload struct {
// The target URL for the webhook request.
URL string `json:"url"`
// The type of activity that triggered this webhook.
ActivityType string `json:"activityType"`
// The resource name of the creator. Format: users/{user}
Creator string `json:"creator"`
// The memo that triggered this webhook (if applicable).
Memo *v1pb.Memo `json:"memo"`
// Optional signing secret for HMAC-SHA256 signature. Not serialized to JSON.
SigningSecret string `json:"-"`
}
Source Files