Roadmap: Use a Secret in Docker Hub Webhooks for Caller validation.

[mghazizadeh]

Tell us about your request
Secure Docker Hub Webhooks

Which service(s) is this request for?
Docker Hub

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
We would like to use Webhooks to provide ready to deploy functions for Docker Hub workflow automation for the community, but we need Hub Webhooks to use some kind of security encryption using a secret so that the caller (ie: Docker Hub) can be validated.
Open to any of these:
Bearer Token
HAMC-SH1
HMAC-SH256
Content Type: application/json
Here is how GitHub does it:
https://developer.github.com/webhooks/creating/?Secret#secret

see also this issue:
https://github.com/docker/hub-feedback/issues/1161

Are you currently working around the issue?
No. The workaround would open a pretty large security hole in our Webhook implementation.

Additional context
Again we want to build publicly available workflow and life cycle automation functions for Docker Hub community using Docker Hub webhooks as the trigger for those automations, but we have to make sure it can be done in a secure manner.

[ingshtrom]

@mghazizadeh Please follow the issue template for creating new issues here. It helps us to parse through information quicker if all of our issues are formatted in a similar way.

@digvan please use reactions on the original issue comment. This helps us to track community response to various issues without cluttering an issue with lots of +1 comments.

[mghazizadeh]

@ingshtrom done! modified to use the issue template.

[pkennedyr]

@mghazizadeh Thanks for submitting this issue - we'll investigate with the team!

Does the community have a preference on the particular security mechanism?

[digvan]

@pkennedyr
The way GitHub is securing the webhook is a good starting point. You can check this link for more information.
https://developer.github.com/webhooks/securing/

Here is also Stripe implementation (which is more secure).
https://stripe.com/docs/webhooks/signatures

[Stitch07]

Any update on this?

[adwaitabhandare]

+1,
Any update on this ?
Github/Gitlab/Bitbucket all provide support for webhook secret auth.