Webhook Tokens

[remchuk]

Hey everyone!

I have a flask server and I want to make it receive only POST requests from NetBox,
Now there is no option for Tokens in NetBox webhook, now I probably miss something with my understanding, but is there a way to make a permanent token for NetBox for all webhooks to be sent with the data?

[markkuleinio]

https://docs.netbox.dev/en/stable/integrations/webhooks/:

Users can specify the receiver URL, HTTP request type (GET, POST, etc.), content type, and headers.

[remchuk]

But is there some examples of how to use them or explanation on how to use them?

[markkuleinio]

If you can tell us what kind of token syntax is your flask server expecting (I, for one, don't have any idea), then someone will probably be able to show you an example of the additional header to be added in NetBox webhook configuration.

[remchuk]

Oh sorry for not explaining!

I don't have any on the flask , that what Im trying to come up with, I'm not fairly familiar with the NetBox webhook custom header .

Im trying to find out how can I make all NetBox webhooks send a token no matter the user in order to make the only allow the flask to receive POST requests from the NetBox.

[kkthxbye-code]

In the header field, just add something like:

X-Auth-Token: mysecrettoken

You can use whatever header you want.

[candlerb]

There is another way, which is that you can set a "secret" as part of the webhook configuration. Then each request will be signed by that secret (a HMAC over the request body), and you make your flask code validate it.

Here is some sample code:
https://github.com/candlerb/netbox-webhook-dnsupdate/blob/master/nb_dns_updater.py#L140-L149
(although this is raw wsgi, not flask)

The advantage over a static header is that it can't be trivially sniffed, although it's still subject to a replay attack.