How to prevent unwanted hook requests?

Question

I developed an application that works with Github and Github Hooks, when a new hook request received, I just update/clone the repository (and then I do a little process on repository)

Because I accept all hook requests blindly, everyone can generate a hook request and send it t me.

I want to know how can I protect my application from unwanted hook requests?

I don't think this is a duplicate, as it is not sure, how a hook request classifies as "unwanted"... @AfshinMehrabani: Please elaborate on this point. — guerda, Mar 12 '13 at 10:16
@AfshinMehrabani: Unfortunately no. What do you define as "unwanted"? How do you decide, that a hook request is unwanted or wanted? — guerda, Mar 12 '13 at 13:08

score 1 · Answer 1 · edited May 23 '17 at 11:43

Github does not include any secret information with the payload (based on https://help.github.com/articles/post-receive-hooks).

So your best defense is to make the url of your webhook hard to guess by using a random string in the url of your web hook.

You may also consider, although this may break over time, checking that request.connection.remoteAddress is within a range of addresses that are know to belong to Github host (Rackspace at the moment?). This answer includes know ip addresses: How to verify a post-receive hook request actually came from github?

How to prevent unwanted hook requests?

1 Answers1