Skip to content

Feat/custom webhook headers support#362

Open
Shadow-MMN wants to merge 4 commits intoEDOHWARES:mainfrom
Shadow-MMN:feat/custom-webhook-headers-support
Open

Feat/custom webhook headers support#362
Shadow-MMN wants to merge 4 commits intoEDOHWARES:mainfrom
Shadow-MMN:feat/custom-webhook-headers-support

Conversation

@Shadow-MMN
Copy link
Copy Markdown

Summary

This PR introduces support for custom HTTP headers in webhook action configurations.

It enables users to define both static and dynamic headers, with dynamic values resolved from event payloads using JSONPath. This improves flexibility when integrating with external services that require custom authentication or metadata.

Type of Change

  • Feature
  • Bug Fix
  • Refactoring
  • Documentation
  • Tests

Linked Issues

Fixes #288

Key Changes

Backend

  • Added customHeaders field to trigger model with validation
  • Implemented header builder utility:
    • Supports static and JSONPath-based dynamic values
    • Resolves headers at runtime during webhook execution
  • Integrated custom headers into webhook service and worker processor

Validation & Security

  • Block unsafe headers (e.g., Host, Content-Length)
  • Enforce header key format rules
  • Sanitize header values to prevent injection
  • Improved handling of invalid or missing JSONPath values

Testing

  • Added unit tests for header builder and JSONPath resolution
  • Updated webhook service tests to include custom header scenarios

Documentation

  • Added /backend/docs/custom-headers.md
  • Includes usage examples, JSONPath patterns, and best practices

Design Decisions

  • JSONPath is used for dynamic resolution to maintain flexibility
  • Headers are resolved at runtime to reflect live event data
  • Multiple JSONPath results are handled explicitly to avoid ambiguity
  • Validation is enforced at both schema and request levels

Notes / Follow-ups

  • Consider centralizing header validation rules to avoid duplication
  • Potential optimization: cache compiled JSONPath expressions
  • Future extensibility: support explicit header value types (e.g., template vs JSONPath)

Acceptance Criteria

  • Feature implemented according to requirements
  • Unit and integration tests added and passing
  • Documentation updated
  • Security and validation considerations addressed

Closes #288

Miracle Nnaji added 3 commits April 27, 2026 13:38
- Add customHeaders field to trigger model with validation
- Implement header builder utility with JSONPath resolution
- Support static and dynamic header values
- Integrate custom headers into webhook service and worker processor
- Add validation middleware using Joi for header configuration
- Block unsafe headers and enforce key format rules
- Handle missing and invalid JSONPath gracefully
- Add comprehensive unit and integration tests
- Document usage, JSONPath examples, and security considerations

chore: refine header handling for production readiness

- Sanitize header values to prevent injection
- Improve JSONPath handling for multi-value results
- Adjust restricted header policy (allow controlled overrides)
- Prepare for centralized validation rules
@drips-wave
Copy link
Copy Markdown

drips-wave Bot commented Apr 27, 2026

@Shadow-MMN Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@Shadow-MMN
Copy link
Copy Markdown
Author

@EDOHWARES , can we check this now ?

@Shadow-MMN
Copy link
Copy Markdown
Author

@EDOHWARES can we check this now ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Backend: Support for Custom HTTP Headers in Action Configurations

1 participant