CODEWITHSUNDEEP
securityazure-functionswebhooksazure-api-managementazure-application-gateway
SliderBlues
SliderBlues

Reputation: 43

Webhook listener/receiver security

We are looking at using webhooks from various vendors outside our network. They would publish the event to us. We would be the webhook listener/receiver, not pushing the events. We have done proof of concept of creating an Azure Function to receive the event. From the research we have done most have the security of passing a sha1/sha256/sha512 hash for us to verify they are who we want to receive the events. This all worked as expected with the POC Azure Function.

From a enterprise network security standpoint is there anything else available? The process above puts the security in the function. I'm sure our Network Security group would not want us to have 10 functions, one for each vendor to worry about the security. I've read about whitelisting of IP's that would be sending the events but most of our vendors are Cloud based so I'm not sure how readily that would be available. Maybe one function to validate all events that come in then let pass through? Would that be an acceptable solution? Azure API Gateway or API Management able to address somehow? Any other network type of product that handles webhook security specifically?

Any insight or link to information most appreciated.

Thanks.

Upvotes: 1

Views: 1331

Answers (1)

Mehmet Taha Meral
Mehmet Taha Meral

Reputation: 3843

Wow, that's really really so open conversation.

You can use Azure Front Door with the Web Application Firewall attached to it. So any SQL injection, DDoS or similar attacks can be prevented by AFD and WAF.

However, I would say the securest way is to put IP restriction as well. So you need to force your vendor to get their IP address. That can be multiple maybe hundreds. But that doesn't matter. You can implement CIDR IP address format so you can cover all network. And you can easily set these IP address restriction during the CI/CD pipeline with Azure PowerShell script.

You can also useAPI Management in front of Azure Functions and you can create access restriction policies. You can either restrict IP based or JWT based. APIM might be a little bit pricey tho.

https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies

You can also create advanced policies with APIM

https://learn.microsoft.com/en-us/azure/api-management/api-management-advanced-policies

Apart from that, the AFD & WAF and IP restriction are on the network layer. But you can also implement token-based authentication on your code side.

https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

You can either you Azure Active Directory, IdentityServer or JWT for this.

Good luck!

Upvotes: 1

Related Questions