Looking to set up incoming webhooks coming from external system into salesforce. Provider states they use HTTP Basic Authentication (HTTPS) in the send. Normally I use a @RestResource and process the @HttpPost. However you can't access the Authorization header using req.headers method. Is there a recommended way to handle incoming webhooks using basic authentication? I set up a public sites visualforce page and controller and I can read the authorization header there but I can't access the post body.
I can think about few possible ways to create webhooks in SF each has its own pros and cons.
- Using Public Apex Rest: You can create a Force.com site and hook it up with your Apex Rest class. https://developer.salesforce.com/blogs/developer-relations/2012/02/quick-tip-public-restful-web-services-on-force-com-sites.html
As Authorization header contains sensitive information, SF won't allow you to read it in your code. It would clean such critical headers before reaching your apex code. Thus you would have to ask the 3rd party to send Authorization in Post body instead of the header.
Using Private Apex Rest: This will allow you to do what you want but the autorization will be taken care by SF, Thus 3rd party will have to get access token from Oauth flow and will consume a full Salesforce License
Using Visual Force Webhook: VF only accepts GET requests, even if you try to POST it will be treated as GET and its body will be lost. Thus you would need to ask the 3rd party to send the post body as URL params.
Using a MiddleWare : Use Salesforce for what it was designed for and leave the complex integration complexity with a middleware like mule.