webtrigger-security

Context

• Forge web triggers are publicly accessible URLs with no built-in authentication. Apps must implement their own authentication, replay protection, and input validation.
• Related CWE: CWE-306 (Missing Authentication for Critical Function).
• Known footgun: PBAC-832 - Webtriggers have no supported authentication mechanism.

Scope & Signals

• Manifest: modules with webtrigger type.
• Handler functions: Receive HTTP request, return HTTP response.
• Risk areas:
  • No authentication header validation.
  • No signature/HMAC verification.
  • No replay protection (timestamp/nonce).
  • Direct processing of untrusted request body.
  • Sensitive operations without auth.

Vulnerable Patterns

// VULNERABLE - No authentication whatsoever
export async function webhookHandler(request) {
  const data = JSON.parse(request.body);
  
  // Directly processing untrusted input
  await storage.set(`data-${data.id}`, data.payload);
  
  // Triggering sensitive operations
  await notifyUsers(data.users);
  
  return { statusCode: 200 };
}

// VULNERABLE - Weak authentication (easily bypassed)
export async function webhookHandler(request) {
  const apiKey = request.headers['x-api-key'];
  
  // Hardcoded comparison (timing attack + hardcoded secret)
  if (apiKey !== 'secret-api-key-12345') {
    return { statusCode: 401 };
  }
  
  // Process request...
}

// VULNERABLE - No replay protection
export async function webhookHandler(request) {
  const signature = request.headers['x-signature'];
  
  if (verifySignature(request.body, signature)) {
    // Valid signature, but could be replayed!
    await processPayment(JSON.parse(request.body));
  }
}

Secure Patterns

import crypto from 'crypto';
import { storage } from '@forge/api';

// SECURE - Full authentication with replay protection
export async function webhookHandler(request) {
  // 1. Verify signature
  const signature = request.headers['x-signature'];
  const timestamp = request.headers['x-timestamp'];
  const nonce = request.headers['x-nonce'];
  
  if (!signature || !timestamp || !nonce) {
    return { statusCode: 401, body: 'Missing auth headers' };
  }
  
  // 2. Check timestamp freshness (prevent replay)
  const requestTime = parseInt(timestamp, 10);
  const now = Date.now();
  const MAX_AGE_MS = 5 * 60 * 1000; // 5 minutes
  
  if (Math.abs(now - requestTime) > MAX_AGE_MS) {
    return { statusCode: 400, body: 'Request expired' };
  }
  
  // 3. Check nonce hasn't been used (prevent replay)
  const nonceKey = `nonce:${nonce}`;
  const usedNonce = await storage.get(nonceKey);
  if (usedNonce) {
    return { statusCode: 400, body: 'Nonce already used' };
  }
  
  // 4. Verify HMAC signature
  const secret = await storage.getSecret('webhook-secret');
  const payload = `${timestamp}.${nonce}.${request.body}`;
  const expectedSig = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSig)
  )) {
    return { statusCode: 401, body: 'Invalid signature' };
  }
  
  // 5. Store nonce to prevent replay
  await storage.set(nonceKey, { used: true }, { ttl: MAX_AGE_MS / 1000 });
  
  // 6. Validate and process request body
  const data = validateAndParse(request.body);
  await processWebhook(data);
  
  return { statusCode: 200 };
}

// Helper: Constant-time comparison
function secureCompare(a, b) {
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
}

Detection Checklist

• Identify all webtrigger modules in manifest.yml.
• For each handler, check for authentication header processing.
• Verify signature validation uses timing-safe comparison.
• Check for timestamp validation (freshness).
• Look for nonce/idempotency key validation.
• Assess what operations the trigger performs (sensitivity).
• Verify input validation before processing body.

Authentication Methods