Channel settings
- Channel name
- HMAC shared key
- Exclusive mode
- Competing consumers mode
- Webhook URL
- WebSocket URL
Events
Instructions
To create a channel, just connect to to the websocket URL, passing in any query parameters to configure the behavior of the channel. Point the webhook producer at the Webhook URL.
Any incoming webhooks will be distributed to the clients connected on the WebSocket URL according to the settings:
- If an HMAC shared key is configured, the server checks that messages are valid and rejects any messages that aren't valid. This signature is not passed on; clients will have to trust the server.
- In Exclusive mode, only one client is allowed to connect to the WebSocket URL.
- In Competing consumers mode, messages are delivered randomly to the connected consumers.
When last consumer disconnects, the channel ceases existing and incoming webhooks will be rejected.
Security considerations
Take these points in consideration for your threat model:
- Use a hard to guess channel name, otherwise anybody can send anything into it.
- If you don't want more than one consumer, use exclusive mode to increase confidentiality.
- By setting an HMAC shared key according to the Standard Webhooks spec, you will have to trust that this server properly validates incoming webhook calls and passes them on unaltered.
- The HMAC shared key is part of the query string, so not only is it resident in the server process memory, it can get logged as well. Anyone with the secret key and knowledge of the channel name can send webhooks.
- I take no responsibility for confidentiality of the data passing through this service, if it's sensitive, consider not using this service.
- When joining an existing channel, the client must supply the exact same configuration as the existing channel, otherwise the WebSocket connection will be rejected. This prevents somebody else creating a channel with a different HMAC shared key or no key at all.