#đź”’ Thunder Client Secret [not python specific]

5 messages · Page 1 of 1 (latest)

bitter folio
#

I'm trying to setup a webhook listening endpoint using Flask. The listening is for ExLibris Alma.

https://developers.exlibrisgroup.com/alma/integrations/webhooks/anatomy/

I've got the endpoint able to respond to the initial challenge (GET). I can also detect the Webhook Event (POST).

I'm using the Thunder Client extension in VS Code to send the requests to my local Flask app (so it's all local)

What I can't quite figure out how to do is send a request with a signature using a shared secret. Following these details (from the page linked above)

Signature
The signature ensures the message came from Alma and that it was not tampered with​. It is recommended (but not required) that the listener validate the signature​. The signature is a Base64 encoded HMAC SHA256​ hash of the entire body payload and is sent in the X-Exl-Signature header. The shared secret is specified in the webhook integration profile.

I've got some basic code that can calculate a signature given the shared secret and a message

import base64
import hashlib
import hmac
import os

from dotenv import load_dotenv

load_dotenv()
ALMA_WEBHOOK_SECRET = os.getenv('ALMA_SECRET')

def calc_secret(secret, message):
    '''
    The signature is a Base64 encoded HMAC SHA256​ hash of the entire body payload and is sent 
    in the X-Exl-Signature header.
    The shared secret is specified in the webhook integration profile.
    '''
    secret = bytes(secret, 'utf-8')
    message = bytes(message, 'utf-8')
    signature = base64.b64encode(hmac.new(secret, message, digestmod=hashlib.sha256).digest())
    return signature # This secret should match what's in the header


print(ALMA_WEBHOOK_SECRET)
msg_sig = calc_secret(ALMA_WEBHOOK_SECRET, 'hello world')
print(msg_sig)

But I can't figure out how to send a test message to my endpoint to make sure I'm processing and comparing the correct values.
Hope all that makes sense? I will try to clarify if not. 🙂

Ex Libris Developer Network
Anatomy of a Webhook - Ex Libris Developer Network

The following describes the pieces that make up an Alma webhook listener. Challenge (GET) When registering a webhook listener as an integration profile, Alma “challenges” the listener. This ensures an active listener is available at the provided URI​. The listener should reply to the GET request with the challenge sent in the querystring​. Alma ...

tough nimbusBOT
#

@bitter folio

Python help channel opened

Remember to:

  • Ask your Python question, not if you can ask or if there's an expert who can help.
  • Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
  • Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.
bitter folio
#

So this is more about Thunder Client than it is code.

tough nimbusBOT
#

@bitter folio

Python help channel closed

This help channel has been closed and it's no longer possible to send messages here. If your question wasn't answered, feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.