3

Still new to working with REST services and apex in general. I have put together a simple REST Service for inserting records with JSON delivered via HTTPPost. Everything works great when I use workbench.developerforce.com to send JSON via post. When I try to send actual data via the third-party webhook I get no record insertions.

I'm fairly certain this is because I haven't told Salesforce it's ok to receive post data from my external source. If I'm understanding correctly I either need to expose my REST service to the public using a force.com site or by using an OAuth flow.

I'd prefer to not have my REST service just publicly available as I wrote it specifically for this single third-party and they should be the only ones using it. However, they are sending data via webhooks, and I have very limited control over them. I can only specify a Payload URL (currently set to my REST service URL) as well as a "Request Header" (which they say will be "included as a value in the POST request's header").

Is it possible to send the necessary info via the post request header to authenticate or do I need to set up a Connected app? If I use a connected app do I point the third-party webhook to a login URL with consumer keys and credentials in the header and then set the callback URL to the REST Service?

Any suggestions or general guidance would be greatly appreciated. Thanks.

Improve this question
4
  • Is your remote service sending messages that can be authenticated in the fashion common among webhooks (transmitting the hash of the message plus a pre-shared secret key)?
    – David Reed
    Commented Jan 25, 2021 at 19:20
  • @DavidReed I'm unsure. How could I tell? Is there documentation on this set up anywhere?
    – Jack S
    Commented Jan 25, 2021 at 19:27
  • 1
    I'm thinking of the way GitHub can do it - unfortunately, their doc here is not as thorough as it might be, but it's basically an HMAC message authentication code with a key your systems share. It lets you authenticate that messages to a public endpoint come from a sender that knows that key. Applicable only if your remote system actually supports that.
    – David Reed
    Commented Jan 25, 2021 at 19:55
  • Thanks for the point in the right direction @DavidReed. I'm guessing it's not the most secure way, but for now I've added a custom header to the third-party webhook and I check for it at the beginning of my HttpPost.
    – Jack S
    Commented Jan 25, 2021 at 23:13

1 Answer 1

Reset to default
3

The best secure way would be to use a Connected App and Server-Server flow

It is always better to authenticate to Salesforce and reach into Salesforce using a connected app.

However, as you pointed that if you do not have a lot of control then you need a proxy server doing this for you.

One approach would be to use a Heroku Node.js app and exposing that to a public endpoint.

This app can look for certain headers and then authenticate and securely store all the credentials required to reach into Salsforce.

Improve this answer
11
  • Am I understanding correctly that using the JWT Bearer Flow (server to server) still essentially requires two calls to my salesforce server? The first sends over the JWT and SF then returns an access token. Then I would need to send that access token via my post header request to the REST service?
    – Jack S
    Commented Jan 25, 2021 at 20:01
  • 2
    correct! Watch the video link I have there that technically will explain all you need to set up a connection and authenticate. Security is hard :)
    – Mohith Shrivastava
    Commented Jan 25, 2021 at 20:12
  • Why use Heroku when you can do all of that in Apex, right here on the same platform ;-)
    – identigral
    Commented Jan 25, 2021 at 21:46
  • 1
    I ended up taking David Reed's suggestion as a quick workaround. I was able to add a custom header:value to the httppost that I can check for on my publicly exposed REST to ensure it's legitimate before taking any actions. I know this is probably not near as safe as using JWT, but for now, I think it will suffice.
    – Jack S
    Commented Jan 25, 2021 at 23:09
  • 1
    It works for now but if someone hacks it up then there will be unnecessary api consumptions! Just something to be aware of
    – Mohith Shrivastava
    Commented Jan 25, 2021 at 23:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .