When you receive a webhook its best practice to ensure the webhook has been received from infoodle. To do this, your process needs to calculate your own sha256 code and compare with the header sent.
Each delivery contains a Signature and the name of the Event that triggered it.
Event Headers
Each webhook infoodle sends out contains the following 2 headers
X-Infoodle-Signature: sha256=...
X-Infoodle-Event: person.created
When you create a new webhook, infoodle will create a new Secret. This key is need to perform the verification.
Verification
To Verify the received webhook:
- take the url you sent
- and the Secret
- and calculate the sha256
- The value should match the signature sent in the header
expected = "sha256=" + hmac_sha256(
raw_request_body,
secret_key
)
assert(expected == header["X-Infoodle-Signature"])