Add HMAC-SHA256 webhook signatures, timestamps, and idempotent delivery IDs to outgoing webhooks
Add HMAC-SHA256 webhook signatures, timestamps, and idempotent delivery IDs to outgoing webhooks: a task in bird-critic-1.5-full-300 (Harbor dataset). Chatwoot's outbound webhooks carry no authentication headers, making it impossible for receivers to verify that a payload genuinely originated from…
The task
Chatwoot's outbound webhooks carry no authentication headers, making it impossible for receivers to verify that a payload genuinely originated from Chatwoot or to detect replays. This PR adds three new headers to every delivery: an HMAC signature, a timestamp, and a stable delivery UUID.
Part of kochsnow/bird-critic-1.5-full-300.