Hello, There’s a couple of things I haven’t been able to find any documentation on: Is there any way during the webhook establishment to get the API asana to use an authentication token when repeating back the x-hook-secret? I suppose I can set a domain level filter for the response and then rel…

Hi @Harrison_Reid , Apologies for the late reply. To answer your question Is there any way during the webhook establishment to get the API asana to use an authentication token when repeating back the x-hook-secret? I suppose I can set a domain level filter for the response and then rely on the x-…

Hey John, Thanks for the answer to number 2. For number 1. this means we would have to expose an API for the initial handshake (i.e we send out a request to establish the webhook, but we receive the secret for the first time). So we would have a fully exposed API for that initial handshake but the…

[image] Harrison_Reid: For number 1. this means we would have to expose an API for the initial handshake (i.e we send out a request to establish the webhook, but we receive the secret for the first time). So we would have a fully exposed API for that initial handshake but then it would be secure…

Hi @Harrison_Reid , I talked to our engineer and Solutions team and they have a few recommendations on making the initial handshake more secure. Here are some things you can do: Minimizing the attack surface: Your webhook server should only listen for and respond to a handshake request during the …

Discord engineer here. This is an unacceptable and absurd security posture from Asana. There is no way to verify that initial payload is coming from Asana; it could come from anywhere and trick a server into trusting future payloads. This setup also requires using some kind of statefulness in an As…

Hi @anon79756254 and welcome! This webhook enhancement has indeed been raised several times internally and is currently in our backlog. I’ve followed up on this request to refresh the discussion with our team. We really appreciate your feedback. I’ll keep an eye on this thread and update the commu…

Hi @anon79756254 , Just following up after discussing with our API team. I had missed an important detail in the Establish a webhook endpoint reference : the X-Hook-Secret is also returned in the API response to POST /webhooks. That response is initiated by you, so you can treat the secret there as…

That does, admittedly, make a lot more sense in terms of security, but it leaves the second problem: requiring the webhook server to be stateful and to understand Asana’s specific handshake/signature protocol. This means a lot of customization around general purpose integration products like Argo Ev…

Hey @Tomer_Gabel , In the webhook scheme, these could be separate: a client creating a webhook subscription a server which is the target for the webhook events In the handshake, the target only needs to echo back the value in the header. This is to prevent our service from being used maliciously …

Securing Webhook Initial Handshake

English Forum Developers & API

Phil_Seeman 25 November 2024 05:32 3

cc: @John_Vu @Andrew-asana

Topic		Replies	Views
Secret used in hmac for webhook seems to be incorrect Developers & API webhooks	1	1617	30 May 2025
Not able to perform webhook handshake? Developers & API webhooks	4	2516	30 May 2025
About Setting up asana webhook with asp.net webmethod Developers & API	6	1922	30 May 2025
Webhook - Identifying webhooks by id to match their secrets Developers & API webhooks	4	464	11 December 2024
not able to create webhook Developers & API tasks , webhooks	6	2621	30 May 2025

Securing Webhook Initial Handshake

Related topics