Webhook

As explained in Secure APIs

A webhook is an HTTP callback that delivers event notifications to a user-specified URL.

A webhook is an HTTP callback that sends event notifications to a user-specified URL. It lets an API trigger automated follow-up actions when events occur. section 5.2

Payment notifications

A payment API can let customers configure webhooks for successful payments, new subscriptions, or failed payments. The API then calls the configured URL when the event occurs. section 5.2

Because users control webhook URLs, attackers may configure them to make the server request internal services. Scanning endpoints such as http://localhost:8080/jobs can reveal databases, Jenkins servers, and internal architecture, enabling more targeted attacks. section 5.2

Figure 5.4 Webhooks are among the most common vectors of SSRF attacks. In this example, a threat actor configures a webhook to scan the local network for a service running at http://localhost:8080/jobs.

Shows how a malicious webhook configuration can scan a local service and demonstrates why webhooks are a common SSRF vector. section 5.2

How Secure APIs covers it

How deep it goes

Traces webhook operation through SSRF abuse, internal-service discovery, and resulting attack preparation.

Examples

Illustrates payment notifications, local-network scanning, PostgreSQL discovery, and Jenkins compromise.

What you can do after

Evaluate webhook configurations for their potential to trigger requests to internal and external services.

How it connects

Connects webhooks with HTTP callbacks, SSRF, payment APIs, PostgreSQL, Jenkins, and SQL injection.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  The Design of Web APIs, Second EditionA webhook call is an HTTP request sent automatically to notify a consumer when an event occurs.
• 

  liveBookmanning.com
  Contract Testing in ActionA webhook is an HTTP callback that delivers an event notification from one system to another when a specified event occurs.
• 

  liveBookmanning.com
  Effective Platform EngineeringA webhook is an HTTP callback mechanism that delivers event notifications from one system to another when specified events occur.
• 

  liveBookmanning.com
  Platform Engineering on KubernetesA webhook is an HTTP callback that allows one system to notify another system when an event occurs.
• 

  liveBookmanning.com
  Effective Conversational AIA webhook is an API endpoint that is invoked automatically when a specified event occurs in another system.

Compare how 6 books explain webhook →

Related concepts

• contractkind of · An API contract is a specification of the operations, data, and behavioral expectations that govern interactions between software components.
• business problemaddresses · A business problem is an organizational need, objective, constraint, or challenge that a proposed solution is intended to address.
• Pact Broker CLIproduced by · A command-line interface for publishing and managing Pact contracts and interacting with a Pact Broker.
• triggerkind of · A trigger is an event, condition, input, or schedule that causes or signals an action, process, or state transition to begin or proceed.
• pollingaddresses · Polling is the repeated checking or querying of a resource, system, or condition, often at intervals, to detect data, events, or state changes.
• JSONuses · JSON is a standardized, language-independent text format for representing structured data using objects, arrays, strings, numbers, Boolean values, and null.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.