Looking to set up incoming webhooks coming from external system into salesforce. Provider states they use HTTP Basic Authentication (HTTPS) in the send. Normally I use a @RestResource and process the @HttpPost. However you can't access the Authorization header using req.headers method. Is there a recommended way to handle incoming webhooks using basic authentication? I set up a public sites visualforce page and controller and I can read the authorization header there but I can't access the post body.

  • VF only accepts GET requests, even if you try to POST it will be treated as GET and its body will be lost. – Pranay Jaiswal May 11 '18 at 21:35

I can think about few possible ways to create webhooks in SF each has its own pros and cons.

  1. Using Public Apex Rest: You can create a Force.com site and hook it up with your Apex Rest class. https://developer.salesforce.com/blogs/developer-relations/2012/02/quick-tip-public-restful-web-services-on-force-com-sites.html

As Authorization header contains sensitive information, SF won't allow you to read it in your code. It would clean such critical headers before reaching your apex code. Thus you would have to ask the 3rd party to send Authorization in Post body instead of the header.

  1. Using Private Apex Rest: This will allow you to do what you want but the autorization will be taken care by SF, Thus 3rd party will have to get access token from Oauth flow and will consume a full Salesforce License

  2. Using Visual Force Webhook: VF only accepts GET requests, even if you try to POST it will be treated as GET and its body will be lost. Thus you would need to ask the 3rd party to send the post body as URL params.

  3. Using a MiddleWare : Use Salesforce for what it was designed for and leave the complex integration complexity with a middleware like mule.

  • 1
    Thanks, this basically confirms my testing. For the rest class I confirmed I couldn't read the authentication header. There looked to be potential promise on the VF page but as you mentioned you can't read post contents (was trying with the pagereference getParameters call since some posts referenced reading the first value), leaving some external middleware solution. Since the provider only supports basic authentication vs full oauth it seems I either have to ignore the authentication and use something like the restresource apex rest class or have to build something externally. – Kevin B May 13 '18 at 3:58
  • I kinda prefer middle ware approach, it givea more freedom. – Pranay Jaiswal May 13 '18 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.