Add ability to "sign" payloads on event triggers

I was looking at using this Laravel package which allows a Laravel application to receive signed payloads. The default signature validator will check that the entire payload is checked using this line:

$computedSignature = hash_hmac('sha256', $request->getContent(), $signingSecret);

We can implement our own custom validator, that just checks for a required header but it would be great to add the ability to sign a payload to ensure its not tampered with!

[jasonmccallister]

@napalm272 when setting up an event trigger, you can set headers by environment variables.

We usually have a key per environment that we rotate on a regular basis. The application that receives the event trigger will reject if the headers and keys don’t match. It is really up to you on how you want to implement event triggers.

This feature request is asking to hash the entire event trigger payload. Given the example payload here, if we were to use an online tool to sign the example payload. The signed hash would look like this:

5dc275454c1622a5a89362833e5f132e38e8ca1c08e2d696c7a464e5f8531cee

The receiving webhook would verify that string against the key it has, so if it was tampered with, the app could ignore the request.

This is the same approach that JWT takes and makes a lot of sense in a distributed world of applications. Hope that clarifies it a little!

[elephant3]

Any progress? This feature request shall be prioritized as it’s security-related