Files

feat: add webhook auth guard and IRC password/username support

Add WEBHOOK_SECRET env var for authenticating incoming Owncast webhooks
via a ?secret= query parameter. Requests with a missing or incorrect
secret are rejected with 401. If unset, all requests are accepted
(with a startup warning).

Also includes previously uncommitted work:
- IRC server password support (IRC_PASSWORD env var, PASS command)
- IRC username/ident field in config
- IRC_PASSWORD and SELinux volume flag in docker-compose.yml

Made-with: Cursor

2026-03-13 00:53:59 -04:00

1.5 KiB

Raw Blame History

Webhook Authentication Guard

Date: 2026-03-13

Task

Add a shared secret (WEBHOOK_SECRET) to the webhook endpoint so only requests with a matching ?secret= query parameter are accepted. This prevents unauthorized parties from injecting events into the bridge.

Changes Made

`src/config.rs`

Added webhook_secret() static method to BridgeConfig — reads WEBHOOK_SECRET env var, returns Option<String>.

`src/webhook.rs`

Added WebhookQuery struct for axum query parameter extraction.
Added secret: Option<String> field to WebhookState.
Updated handle_webhook to validate the secret before processing: returns 401 if configured secret doesn't match.
Updated run_webhook_server signature to accept secret: Option<String>; logs a warning at startup if unset.
Added 4 integration tests using tower::ServiceExt::oneshot: correct secret (200), wrong secret (401), missing secret (401), no secret configured (200).

`src/main.rs`

Reads WEBHOOK_SECRET via config::BridgeConfig::webhook_secret().
Passes the secret to webhook::run_webhook_server().

`docker-compose.yml`

Added WEBHOOK_SECRET=${WEBHOOK_SECRET} to environment section.

`config.example.toml`

Added comment documenting the WEBHOOK_SECRET env var.

`README.md`

Updated webhook URL example to include ?secret= parameter.
Added environment variables table documenting all three secrets.

`Cargo.toml`

Added tower (0.5, util feature) as dev dependency for handler tests.

Follow-up Items

None. All 65 tests pass.

1.5 KiB Raw Blame History

Webhook Authentication Guard

Task

Changes Made

src/config.rs

src/webhook.rs

src/main.rs

docker-compose.yml

config.example.toml

README.md

Cargo.toml