Autentikasi Webhook

Authorization: {your_secret_key}

const SECRET_KEY = 'your_secret_key';

app.post('/webhook', (req, res) => {
  const authHeader = req.headers.authorization;
  
  if (authHeader !== SECRET_KEY) {
    console.error('Secret webhook tidak valid');
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  // Proses webhook...
  res.status(200).send('OK');
});

from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET_KEY = 'your_secret_key'

@app.route('/webhook', methods=['POST'])
def webhook():
    # Validasi autentikasi
    auth_header = request.headers.get('Authorization')
    if auth_header != SECRET_KEY:
        print('Secret webhook tidak valid')
        return jsonify({'error': 'Unauthorized'}), 401
    
    # Proses webhook...
    return 'OK', 200

<?php
$SECRET_KEY = 'your_secret_key';

function webhookHandler() {
    global $SECRET_KEY;
    
    // Validasi autentikasi
    $authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
    if ($authHeader !== $SECRET_KEY) {
        error_log('Secret webhook tidak valid');
        http_response_code(401);
        echo json_encode(['error' => 'Unauthorized']);
        return;
    }
    
    // Proses webhook...
    http_response_code(200);
    echo 'OK';
}

webhookHandler();
?>

// ❌ Buruk - Secret di-hardcode
const SECRET_KEY = 'secret_123456';

// ✅ Bagus - Environment variable
const SECRET_KEY = process.env.WEBHOOK_SECRET_KEY;

const rateLimit = require('express-rate-limit');

const webhookRateLimit = rateLimit({
  windowMs: 60 * 1000, // 1 menit
  max: 100, // Batasi setiap IP ke 100 request per windowMs
  message: 'Terlalu banyak request dari IP ini'
});

app.use('/webhook', webhookRateLimit);

app.post('/webhook', (req, res) => {
  const authHeader = req.headers.authorization;
  const clientIP = req.ip;
  
  if (authHeader !== SECRET_KEY) {
    console.error(`Percobaan webhook tidak sah dari IP: ${clientIP}`);
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  console.log(`Webhook diterima dari IP: ${clientIP}`);
  // Proses webhook...
  res.status(200).send('OK');
});

// Dukung beberapa secret aktif untuk rotasi
const SECRET_KEYS = [
  process.env.WEBHOOK_SECRET_KEY,
  process.env.WEBHOOK_SECRET_KEY_OLD
];

app.post('/webhook', (req, res) => {
  const authHeader = req.headers.authorization;
  
  if (!SECRET_KEYS.includes(authHeader)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  // Proses webhook...
  res.status(200).send('OK');
});

app.post('/webhook', (req, res) => {
  const authHeader = req.headers.authorization;
  
  // Debug logging (nonaktifkan di produksi!)
  console.log('Auth header diterima:', authHeader);
  console.log('Secret yang diharapkan:', SECRET_KEY);
  console.log('Cocok:', authHeader === SECRET_KEY);
  
  if (authHeader !== SECRET_KEY) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  // Proses webhook...
  res.status(200).send('OK');
});