IP Whitelisting

👍

TL;DR

• We can ensure your webhooks are sent from a static IP (for you to whitelist) as an extra option of our Pro Plan.
• We advice you to implement proper webhook's signature verification anyway. This is the best way to authenticate webhooks and it combines well with IP whitelisting.

The tradeoffs of IP Whitelisting for Outbound Webhooks

Understanding Outbound Webhooks

Webhooks are automated messages sent from one application (Hook0) to another when a certain event happens. They are HTTP callbacks that provide real-time information, making them a crucial part of many modern applications.

As explained more deeply in Consuming Webhooks, your target application should be able to differentiate genuine webhooks from forged webhooks and reject the latter.

Understanding IP Whitelisting

IP whitelisting is a security measure where you specify a list of trusted IP addresses or IP ranges that can access your service. When it comes to webhooks, IP whitelisting allows you to specify the IP addresses that can send webhooks to your application (and reject the others).

Benefits of IP Whitelisting

• Enhanced Security: IP whitelisting adds an additional layer of security by ensuring that only trusted sources can send webhooks to your application.
• Simplicity: Because this "authentication" happens at the network level, it does not add complexity your application's code.

Limitations of IP Whitelisting

Despite its benefits, IP whitelisting should not be the sole method of authentication due to the following limitations:

• Shared IPs: Depending on our/your cloud provider, you could be sharing your IP address with other users of said cloud provider. This can potentially lead to security issues if those users send malicious requests.
• IP Address Reuse: There's a possibility that you might accidentally release your IP address back to the cloud provider, which can then be used to send malicious requests.
• Inter-Customer Interference: If different Hook0 customers are using the same set of IP addresses, one customer could send whitelisted webhooks to another customer's target application.
• IP Spoofing: in some cases, source IP addresses can be spoofed at the network-level, which could allow untrusted sources to by-pass whitelisting.
• Webhook Alteration: IP whitelisting does not prevent the contents of webhooks for being modified in a MITM attack scenario.

How Hook0 Implements IP Whitelisting

By default, Hook0 does not send webhooks using a custom IP address. Webhooks are sent from multiple IPs which can vary from one webhook to another.

If you need the webhooks of your organization to be sent from a static IP, this is something we can provide as an extra option of our Pro Plan. Contact support to ask for this feature or if you have any question!

For the record, here is a list of static IP addresses we may be using:

• 51.15.106.174
• 151.115.75.197

Note that our support will tell you which one(s) will be attached to your organization upon enabling the option.