Skip to content

WebhookEngine v0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@voyvodka voyvodka released this 29 Jul 08:29
v0.4.0
f28c9fe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

WebhookEngine v0.4.0

Reliability and security release. A full audit closed the delivery-correctness and API defects behind double delivery, silent message loss, and racy manual retries, alongside three security fixes and the operator backlog metrics an alert can actually fire on. No breaking API changes — the v1 prefix, the Standard Webhooks signature surface, and the WebhookEngine.Sdk public API are unchanged.

Security

  • Authenticated SignalR delivery hub. /hubs/deliveries was mapped with no authorization while the notifier fans every delivery event to Clients.All — any anonymous client that could reach the host received the system-wide delivery firehose for all applications, defeating the AppId isolation enforced everywhere else. The hub now requires the dashboard cookie scheme, with /negotiate gated too.
  • IP allowlist enforced at connect time (DNS-rebinding hardening). The allowlist was checked in the worker against its own DNS resolution, but the delivery connection re-resolved the host and pinned to that result. Hostile DNS could return an allowlisted IP to the check and a different one to the connection. The connect callback now enforces the allowlist on the same resolution it pins to.
  • Login rate limiting. POST /api/v1/auth/login had no throttle, so seeded admin credentials could be brute-forced online. It now carries a fixed-window limiter (5 attempts/minute per client IP, configurable under WebhookEngine:LoginRateLimit).
  • Portal endpoint-test preview no longer leaks custom-header values. The portal test response redacts every operator-configured custom-header value while preserving the Standard Webhooks signed headers.

Fixes

  • Delivery lifecycle hardened. Per-message CAS lock refresh stops StaleLockRecoveryWorker from reclaiming a message a live worker is still delivering; delivery now runs on a per-request timeout independent of shutdown so an in-flight message finalizes cleanly on SIGTERM; and error recovery is a CAS reset that can no longer regress a Delivered/DeadLetter row back to Pending.
  • A failed enqueue no longer silently drops a sibling message. A poisoned DbContext on fan-out meant a later endpoint never received the webhook while the API still returned success.
  • Manual retry is race-safe, and a circuit-open endpoint no longer burns a message's retry budget into a premature dead-letter.
  • List pagination is bounded across all 11 paginated routes (?pageSize=2000000000 could materialize an entire tenant's messages table), date filters accept naked dates, and the secretOverride signing-secret rule is enforced on every surface.
  • Dashboard live auto-refresh no longer freezes after the 20-event feed cap — the message table and 24-hour counters stayed frozen while the page still looked live.
  • Query performance on the growth paths. New partial index for the retry sweep, an index for the timeline scan, and endpoint-stats p95 computed via percentile_cont instead of loading every attempt's latency into memory.

Features

  • Operator backlog metrics. Three new Prometheus gauges — webhookengine_queue_depth, webhookengine_queue_oldest_pending_age (head-of-line latency, the real SLO signal), and webhookengine_circuit_open — refreshed by a background collector every 15s so the scrape path stays cheap. These replace a queue-depth up/down counter that drifted monotonically negative on every retry, making the documented backlog alert unfireable.

Upgrade notes

  • webhookengine_queue_depth changes semantics from a drifting counter to a real gauge; existing alerts on it become meaningful rather than dead.
  • Endpoint-stats p95 is now a continuous-interpolated percentile (the standard definition) rather than a nearest-rank sample, so the value can differ slightly for identical data.
  • Replaying a message now applies the currently configured RetryPolicy:MaxRetries rather than the original message's cap.

Quick Start

docker pull voyvodka/webhook-engine:0.4.0
docker compose up -d

Links

Assets 2
Loading