How to secure Webhook configuration page

Products

• Endevor

Issue/Introduction

Webhook is installed onto system XXXX, webhook configuration page can be accessed via URL https://host:port/mfwebhookserver/#!/webhooks with no authentication, webhooks can be amended or deleted by anyone.

How to secure webhook configuration and only allow webhook admins to access this page ? 

 

 

Environment

Release : 19.0

Cause

None of the webhook rest endpoints are protected in the WEB-INF/web.xml for the webhook server.

  <security-constraint>
    <display-name>Allow methods for Tomcat CCS 9.X</display-name>
    <web-resource-collection>
      <web-resource-name>WH rest</web-resource-name>
      <url-pattern>/rest/*</url-pattern>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
      <http-method>PUT</http-method>
      <http-method>OPTIONS</http-method>
      <http-method>HEAD</http-method>
      <http-method>PATCH</http-method>
      <http-method>DELETE</http-method>
    </web-resource-collection>
  </security-constraint>

Resolution

Edit web.xml file, modify the "Secured" web resource security constraint to add an authentication constraint, security role, and login configuration. and comment out the "Allow methods for Tomcat CCS 9.X" security constraint. 

  <security-constraint>
    <display-name>Secured</display-name>
    <web-resource-collection>
      <web-resource-name>Secured area</web-resource-name>
      <url-pattern>/rest/*</url-pattern>
    </web-resource-collection>

    <auth-constraint>
      <role-name>WHAdmin</role-name>
    </auth-constraint>
  </security-constraint>

  <security-role>
    <role-name>WHAdmin</role-name>
  </security-role>

  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Basic Authentication Area</realm-name>
  </login-config>

 

Add the role and connect users to that role to <tomcat dir>\conf\tomcat-users.xml

  <role rolename="WHAdmin"/>
  <user username="<username>" password="<password>" roles="WHAdmin"/>

Additional Information

For more information, check out Secure a Webhook Configuration