Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view

This file was deleted.

This file was deleted.

42 changes: 0 additions & 42 deletions Kontent.Ai.AspNetCore.Tests/SignatureMiddlewareTests.cs
Original file line number Diff line number Diff line change
Expand Up @@ -47,47 +47,5 @@ public async Task RequestWithInvalidSignatureEmptyBody_ReturnsUnauthorized(strin
// Assert
Assert.Equal(ctx.Response.StatusCode, (int)HttpStatusCode.Unauthorized);
}

[Theory]
[InlineData("X-KC-Signature", "ezKcSmuYrugdCN73QVWDXREaNY7AkUhFWksUFlp9Tnc=", "PublishDeliveryTriggerWebhookBody.json", "fiJ+MiJxiqmzbnlVzWnR+7Rgas7aDSzsqIApflYiZ4o=", HttpStatusCode.NotFound)]
[InlineData("X-KC-Signature", "8UXIHkZ6KuarukFbZDhzyeVAHcKkFnlLabScv9VyNww=", "PublishManagementTriggerWebhookBody.json", "khBZy02UmiUrp2bl1ooPJdILKUmmL2Q7kx318+arMhM=", HttpStatusCode.NotFound)]
[InlineData("X-KC-Signature", "8UXIHkZ6KuarukFbZDhzyeVAHcKkFnlLabScv9VyNww=", "PublishDeliveryTriggerWebhookBody.json", "tampered-body-hash", HttpStatusCode.Unauthorized)]
[InlineData("X-KC-Signature", "8UXIHkZ6KuarukFbZDhzyeVAHcKkFnlLabScv9VyNww=", "PublishManagementTriggerWebhookBody.json", "tampered-body-hash", HttpStatusCode.Unauthorized)]
[InlineData("X-Kontent-ai-Signature", "ezKcSmuYrugdCN73QVWDXREaNY7AkUhFWksUFlp9Tnc=", "PublishDeliveryTriggerWebhookBody.json", "fiJ+MiJxiqmzbnlVzWnR+7Rgas7aDSzsqIApflYiZ4o=", HttpStatusCode.NotFound)]
[InlineData("X-Kontent-ai-Signature", "8UXIHkZ6KuarukFbZDhzyeVAHcKkFnlLabScv9VyNww=", "PublishManagementTriggerWebhookBody.json", "khBZy02UmiUrp2bl1ooPJdILKUmmL2Q7kx318+arMhM=", HttpStatusCode.NotFound)]
[InlineData("X-Kontent-ai-Signature", "8UXIHkZ6KuarukFbZDhzyeVAHcKkFnlLabScv9VyNww=", "PublishDeliveryTriggerWebhookBody.json", "tampered-body-hash", HttpStatusCode.Unauthorized)]
[InlineData("X-Kontent-ai-Signature", "8UXIHkZ6KuarukFbZDhzyeVAHcKkFnlLabScv9VyNww=", "PublishManagementTriggerWebhookBody.json", "tampered-body-hash", HttpStatusCode.Unauthorized)]
// https://docs.microsoft.com/en-us/aspnet/core/test/middleware
public async Task TriggerRequest_WithValidSignature_CorrectStatusSet(string headerName, string authorizationSecret, string bodyFilename, string signature, HttpStatusCode resultStatus)
{
using var host = await new HostBuilder()
.ConfigureWebHost(webBuilder =>
{
webBuilder
.UseTestServer()
.Configure(app =>
{
app.UseWebhookSignatureValidator(context =>
true,
new WebhookOptions
{
Secret = authorizationSecret
}
);
});
})
.StartAsync();

var responsePath = Path.Combine(Environment.CurrentDirectory, "Data", "Legacy", bodyFilename);
var server = host.GetTestServer();
var context = await server.SendAsync(c =>
{
c.Request.Method = HttpMethods.Post;
c.Request.Headers.Add(headerName, signature);
c.Request.Body = new StringContent(File.ReadAllText(responsePath)).ReadAsStream();
});

Assert.Equal(context.Response.StatusCode, (int)resultStatus);
}
}
}
71 changes: 0 additions & 71 deletions Kontent.Ai.AspNetCore/Webhooks/Models/Legacy/Common.cs

This file was deleted.

This file was deleted.

This file was deleted.

4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,13 +77,13 @@ public void ConfigureServices(IServiceCollection services)

## Webhooks

Package provides a model for webhook deserialization: `WebhookNotification`. Legacy webhooks are supported via classes `DeliveryWebhookModel` and `ManagementWebhookModel`, to be used with legacy (preview) delivery API and management API triggers respectively. See [Webhooks reference](https://kontent.ai/learn/reference/webhooks-reference/) in Kontent.ai documentation.
Package provides a model for webhook deserialization: `WebhookNotification`.

## Middlewares

### Webhook signature verification middleware

This middleware verifies the `X-Kontent-ai-Signature` (and the legacy `X-KC-Signature`) header. Returns 401 response if the signature is invalid.
This middleware verifies the `X-Kontent-ai-Signature` header. Returns 401 response if the signature is invalid.

`appsettings.json`:

Expand Down
Loading