Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added support for Bearer token on Webhook class #1784

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Added support for Bearer token on Webhook class #1784

wants to merge 2 commits into from

Conversation

SDugo
Copy link

@SDugo SDugo commented Feb 8, 2021

Webhook class now supports the addition of an optional "token". It needs to be declared at the same level that "url" on the application.conf file. If the parameter exists within a webhook definition, its value will be added to an Authorization header. Else, the send() function of the Webhook class won't include this header on the POST request.

An example of configuration on the application.conf would be as follows:

webhooks {
  myLocalWebHook {
    url = "http://localhost/webhook"
    token = "xxxxxxxxxxxxxxxxxx"
  }
}

So, in order to test this solution you should:

  1. Download and compile the code.
  2. Add the webhook configuration to the compiled instance. I attached a demo configuration just for testing purposes.
    PR_Issue-1690-application.conf.txt
  3. Create and run two different webhooktest.py files, each one on one port so you can receive the same event with and without the bearer token. Also attached to this PR.
    PR_Issue-1690-webhooktest_1.py.txt
    PR_Issue-1690-webhooktest_2.py.txt
  4. Launch TheHive with the demo configuration file.
  5. Check the webhooktest instances to see how it behaves when you add or not the "token" parameter to the configuration.
    PR_Issue-1690_webhook with bearer token
    PR_Issue-1690_webhook without bearer token

I am a beginner on Scala, so maybe there is an easier way to achieve this goal. In any case, I tested the code and seems to work on TheHive 3.5.0-1 which is the version that I could download from the build it yourself section.

@SDugo
Added support for Bearer token on Webhook class
56d33c5 
Webhook class now supports the addition of an optional "token". It needs to be declared at the same level that "url" on the application.conf file. If the parameter exists within a webhook definition, its value will be added to an Authorization header. Else, the send() function of the Webhook class won't include this header on the POST request.

An example of configuration on the application.conf would be as follows:
webhooks {
  myLocalWebHook {
    url = "http://localhost/webhook"
    token = "xxxxxxxxxxxxxxxxxx"
  }
}
@nadouani
Copy link
Contributor

Hello, thanks @SDugo for the PR. I would add another configuration called tokenName that defaults to Bearer and allows setting other values like token that might be used in some APIs.

@SDugo
Update WebHook.scala
bc906aa 
Added the optional parameter "tokenName", with a "Bearer" default value.
@SDugo
Copy link
Author

SDugo commented Feb 27, 2021 •
edited
Loading

Hi @nadouani,

I just added the tokenName parameter, as optional, with a default value of "Bearer".

An example of configuration on the application.conf would be as follows:

webhooks {
  myLocalWebHook {
    url = "http://localhost/webhook"
    tokenName = "TheHive"
    token = "xxxxxxxxxxxxxxxxxx"
  }
}

This way, there will be three scenarios:

  1. No token was declared on the webhook section: no Authorization header will be included on the request.
  2. A token was included on the webhook section but the tokenName was not: the Authorizarion header will be included on the request and the "Type" part will be "Bearer".
  3. A token and a tokenName were included on the webhook section: the Authorizarion header will be included on the request and the "Type" part will be the value of the tokenName field.

So, in order to test this solution you should:

  1. Download and compile the code.
  2. Add the webhook configuration to the compiled instance. I attached a demo configuration just for testing purposes.
    PR_Issue-1690-application.conf.txt
  3. Create and run three different webhooktest.py files, each one using a different port so you check the three scenarios with the same event. Also attached to this PR.
    PR_Issue-1690-webhooktest_1.py.txt
    PR_Issue-1690-webhooktest_2.py.txt
    PR_Issue-1690-webhooktest_3.py.txt
  4. Launch TheHive with the demo configuration file.
  5. Check the webhooktest instances to see how it behaves when you add or not the token and tokenName parameters to the configuration.
    image
    Scenario 1
    image
    Scenario 2
    image
    Scenario 3

@dadokkio dadokkio closed this Apr 23, 2021
@dadokkio dadokkio deleted the branch TheHive-Project:master April 23, 2021 08:44
@nadouani nadouani reopened this Apr 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
TheHive3
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@SDugo @nadouani @dadokkio