Aspnetcore: ASP.NET Core Webhooks

[Misiu]

WebHooks repository was merged into AspLabs and it isn't getting any ❤️
There was 1.0.0-preview3-final but after that, the development lost its momentum or even stopped completely.
I don't see anything about WebHooks in the roadmap and in the announcement.
I've tried getting feedback in https://github.com/aspnet/AspLabs/issues/38 and I got a response from @danroth27 that there aren't any plans to ship WebHooks at this time.

Some time ago I had to use WebHooks with Pusher in an old project, so I've ported Pusher to old AspNetWebHooks (https://github.com/aspnet/AspNetWebHooks/pull/37) and now I plan to move my app to ASP.NET Core, but WebHooks are missing.

I'd like to ask You guys to reconsider Your decision because WebHooks are commonly used and they are missing in ASP.NET Core, we need the basic implementation, then the community could contribute.

[mkArtakMSFT]

Hi @Misiu.
That decision hasn't changed. Webhooks is not an area of focus for us and won't be in the near future.
//cc @danroth27

[mguinness]

Sad to hear that WebHooks is being left to wither on the vine. I created Webhook for Box and would also consider looking at Webhook for AWS SNS, but it seems like it would be a wasted effort if the underlying framework is abandoned.

I understand Microsoft has limited resources, but since there doesn't appear to be an alternative solution (from what I can see) then developers using ASP.NET Core have to reinvent the wheel if they need to develop a webhook. I wonder if this project would be suitable for GitHub Sponsors to get it going again with help from the community?

[danroth27]

@mguinness At this point I think we'd be interested in spinning https://github.com/aspnet/AspLabs/tree/master/src/WebHooks off as a community based project. This would involve moving the code out to a new community GitHub org and repo. Is this something you might be interested in taking on? I'm guessing you can probably recruit some folks from the community to help out.

[mguinness]

Thanks for the reply Dan, I think that would be a good option. I don't really have the technical ability to manage the project, but I'd like to contribute. The only person I've seen that has a good grasp of the project (from my research) is @tpeczek, but I don't know if he would be interested.

In another project I've been involved in there was talk of Should we join the .NET Foundation? and it seems that this project would be a good fit. Maybe we could get support from companies like SalesForce, Stripe, Trello etc as it would further their integration efforts, albeit on a .NET stack.

[danroth27]

I've been involved in there was talk of Should we join the .NET Foundation? and it seems that this project would be a good fit

Yup, if someone wants to take this project on (@tpeczek?) then once the project has got its footing then I'm happy to help out with the process of getting the project into the .NET Foundation.

[WestDiscGolf]

It felt at the time, last time I looked properly at it, that it was waiting for the new end point routing which came with aspnet core 3 which is why it stalled. I wrote a Webhook for a fitbit subscription but I remember it not being overly straightforward to understand what was going on - https://github.com/WestDiscGolf/Fitbit.Net-Webhook - so I think it needs a review and made easier (or at least better documentation) to aid with people using it.

[mguinness]

Yes, it probably needs reimagining for ASP.NET Core 3.0 and to just focus on receivers (senders would be another library).

Actual service implementations would be better served by being in their own repos so they can be supported by their respective owners.

A core library is needed to provide common ComputeRequestBodySha256HashAsync, FromBase64, SecretEqual functions.

As detailed in Webhook receivers in AspNetCore a main function of a filter is signature verification.

Webhooks receivers must meet some conditions in order to be secure. Firstly, they need to be exposed over HTTPS. Secondly, there must be a mechanism of verifying authenticity (and the origin) of incoming messages. Also receiver’s URL should be difficult to guess.

From a processing standpoint, could these receivers be implemented by just using middleware or
Resource filters? It would be good to get input from the architects of ASP.NET WebHooks at Microsoft to understand the design goals.

[falvarez1]

Did this project get picked up somewhere or is the AspLabs the most current implementation still?

[mguinness]

AFAIK it hasn't been picked up. WebHooks in AspLabs is no longer maintained and the issues feature was removed Aug 28. It's basically up to each developer to roll their own solution which is unfortunate but that's where it stands right now.

BTW, if you do end up rolling your own solution please consider creating a repo and adding a link to it here so that it will minimize others reinventing the wheel. Also if a community based project is undertaken there will be a ready source available.