Authenticated channels

Even though channel names are random, it seems a little sketchy to broadcast events to any client that can guess a URL. It’d be great to have authenticated channels that prevent random clients from eavesdropping.

Here are a couple options for how it could work:

1. Pass the webhook secret in the Authorization header when the client connects. Before webhooks are delivered to a client, use the secret provided by the client to verify the signature. If it doesn’t validate, avoid delivering the event (and maybe even reject the client with a 401).

2. Add OAuth to smee.io and generate a secret for each user. The user can create channels as smee.io/:username/anything-you-want, but any channel starting with /:username/ must include the user’s token in the Authorization header.

Either way, the client would have to pass a secret, it’s just a question of whether that is the webhook secret configured on GitHub, or a secret from smee.io

new EventSource("https://smee.io/my-channel-name", {
  headers: {"Authorization": "my-secret"}
});

cc https://github.com/bkeepers/webhook-proxy/issues/3

[tcbyrd]

Authentication is not likely going to be added to smee.io. Another team is working on a native integration using the gh command line, which will likely be the best way forward for people who need this feature: https://github.blog/changelog/2022-11-16-webhook-forwarding-in-the-github-cli-public-beta/

Once that feature is out of beta, we may end up shutting down smee.io entirely since it’s effectively the same functionality with a better integration.

cc @gr2m in case you have any other thoughts, but I’m going to close this issue for now.

[dhirschfeld]

Are there any plans to add this functionality? Unfortunately, I won’t be able to make use of this service without it 😦