Table of Contents

Secure the deployment

The webhook receives confidential information and holds the keys to your systems. Apply these measures before any production use.

Expose only the webhook address

Only the /api/webhook* routes check the SESAR call. The management routes require no authentication:

Route What it allows
/api/connectors, /api/connectors/{id}/test List the connectors and trigger their connection tests
/api/handlers, /api/handlers/{id}/test, /api/handlers/rescan List the handlers, test them, read their folder again
/api/health/status Read the application's state, with server paths, the account name and the machine name
/api/debug/* Process a plain-text manifest, if EnableDebugEndpoints is true

Measures:

  1. Filter by IP address. Firewall, IIS IP address restrictions or a reverse proxy: on /api/webhook*, accept only the address of the SESAR machine.
  2. Block the other routes from outside. If you need them, reach them only from the server itself or your administration network.
  3. Add a secret header with WebHook_Headers in the SESAR configuration, and have your reverse proxy check it before passing the request on.
  4. Leave reachable only the addresses SESAR uses: the Enabled key does not disable a connector.

Production settings

Setting Value
ASPNETCORE_ENVIRONMENT Production: in development, ASP.NET Core shows exception details.
EnableDebugEndpoints false. Never true outside your workstation.
AllowedHosts Your server's name, for example webhook.example.com, rather than *.
DataProtectionScope CurrentUser.
Bindings HTTPS only, no HTTP binding.

Protect the secrets

  • Follow Secrets and DPAPI: file outside the project, encrypted at startup, checked afterwards.
  • Keep the original values in a secret store, never in a repository or an email.
  • Change the webhook key and IV if you suspect a leak, in SESAR and in the secrets file.

Protect the handlers folder

The application loads and runs any DLL in the handlers folder, without checking a signature. A loaded DLL can read all the application's secrets.

  • Reserve write access to this folder to administrators. The application's account only needs to read it.
  • Only drop there DLLs whose code you know.

Personal information

Manifests contain personal information: email addresses, phone numbers, subjects, file names.

  • The default connector, File system, writes each decrypted manifest in plain text to disk. In production, choose another DefaultConnectorId, or protect its folder: restricted access, encrypted disk, defined retention period.
  • The webhook's responses can contain detailed error messages, even server paths: only SESAR should be able to read them.
  • In your handler, log neither the manifest nor the decrypted content (WebhookContext.RawPayload), and do not return them in the IntegrationResult.
  • Host the server, its backups and its logs in Canada if your obligations require it, and document where each connector stores the data (Quebec's Law 25).