How to verify that Google PubSub is hitting my endpoint and not another actor
I have a fully functional endpoint that will receive a POST request from a PubSub subscription when a change has been detected in a user's Gmail inbox. Inside of the endpoint, I can successfully extract everything I need for my purposes.
The problem is that I have no idea who is actually hitting my endpoint. A bad actor could just pass me the same payload that Gmail would.
Is there a way for me to verify that the payload that I'm receiving is actually from Google/Gmail/PubSub?
On the Gmail side:
It seems the payload that is sent to my endpoint is unable to be changed and will always be of the form as detailed here:
https://developers.google.com/gmail/api/guides/push
On the PubSub side:
You can create your own topic and add key/value pairs as custom attributes to it, but it seems I wouldn't be able to modify the payload that Gmail is publishing to my topic.
https://cloud.google.com/pubsub/docs/publisher
Any insight would be greatly appreciated thank you!
gmail-api google-cloud-pubsub
asked Nov 13 '18 at 17:43
RichardRichard
103
add a comment |
I have a fully functional endpoint that will receive a POST request from a PubSub subscription when a change has been detected in a user's Gmail inbox. Inside of the endpoint, I can successfully extract everything I need for my purposes.
The problem is that I have no idea who is actually hitting my endpoint. A bad actor could just pass me the same payload that Gmail would.
Is there a way for me to verify that the payload that I'm receiving is actually from Google/Gmail/PubSub?
On the Gmail side:
It seems the payload that is sent to my endpoint is unable to be changed and will always be of the form as detailed here:
https://developers.google.com/gmail/api/guides/push
On the PubSub side:
You can create your own topic and add key/value pairs as custom attributes to it, but it seems I wouldn't be able to modify the payload that Gmail is publishing to my topic.
https://cloud.google.com/pubsub/docs/publisher
Any insight would be greatly appreciated thank you!
gmail-api google-cloud-pubsub
asked Nov 13 '18 at 17:43
RichardRichard
103
add a comment |
I have a fully functional endpoint that will receive a POST request from a PubSub subscription when a change has been detected in a user's Gmail inbox. Inside of the endpoint, I can successfully extract everything I need for my purposes.
The problem is that I have no idea who is actually hitting my endpoint. A bad actor could just pass me the same payload that Gmail would.
Is there a way for me to verify that the payload that I'm receiving is actually from Google/Gmail/PubSub?
On the Gmail side:
It seems the payload that is sent to my endpoint is unable to be changed and will always be of the form as detailed here:
https://developers.google.com/gmail/api/guides/push
On the PubSub side:
You can create your own topic and add key/value pairs as custom attributes to it, but it seems I wouldn't be able to modify the payload that Gmail is publishing to my topic.
https://cloud.google.com/pubsub/docs/publisher
Any insight would be greatly appreciated thank you!
gmail-api google-cloud-pubsub
asked Nov 13 '18 at 17:43
RichardRichard
103
I have a fully functional endpoint that will receive a POST request from a PubSub subscription when a change has been detected in a user's Gmail inbox. Inside of the endpoint, I can successfully extract everything I need for my purposes.
The problem is that I have no idea who is actually hitting my endpoint. A bad actor could just pass me the same payload that Gmail would.
Is there a way for me to verify that the payload that I'm receiving is actually from Google/Gmail/PubSub?
On the Gmail side:
It seems the payload that is sent to my endpoint is unable to be changed and will always be of the form as detailed here:
https://developers.google.com/gmail/api/guides/push
On the PubSub side:
You can create your own topic and add key/value pairs as custom attributes to it, but it seems I wouldn't be able to modify the payload that Gmail is publishing to my topic.
https://cloud.google.com/pubsub/docs/publisher
Any insight would be greatly appreciated thank you!
gmail-api google-cloud-pubsub
gmail-api google-cloud-pubsub
asked Nov 13 '18 at 17:43
RichardRichard
103
asked Nov 13 '18 at 17:43
RichardRichard
103
asked Nov 13 '18 at 17:43
RichardRichard
103
asked Nov 13 '18 at 17:43
RichardRichard
103
asked Nov 13 '18 at 17:43
RichardRichard
103
103
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
The suggested way to do this is to include a secret as a url parameter for your endpoint. You could then reject any urls which do not include this secret.
https://cloud.google.com/pubsub/docs/faq#security
This could be configured as part of your normal push endpoint when you set up a push subscription.
If you wish to add extra metadata to the provided gmail messages, you could always set up a cloud dataflow job or cloud function as a subscriber directly from the gmail topic, and republish on a second topic which your external endpoint will read from.
-Daniel
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
Thanks so much Daniel! This is exactly what I needed.
– Richard
Nov 13 '18 at 22:24
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53286736%2fhow-to-verify-that-google-pubsub-is-hitting-my-endpoint-and-not-another-actor%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The suggested way to do this is to include a secret as a url parameter for your endpoint. You could then reject any urls which do not include this secret.
https://cloud.google.com/pubsub/docs/faq#security
This could be configured as part of your normal push endpoint when you set up a push subscription.
If you wish to add extra metadata to the provided gmail messages, you could always set up a cloud dataflow job or cloud function as a subscriber directly from the gmail topic, and republish on a second topic which your external endpoint will read from.
-Daniel
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
Thanks so much Daniel! This is exactly what I needed.
– Richard
Nov 13 '18 at 22:24
add a comment |
The suggested way to do this is to include a secret as a url parameter for your endpoint. You could then reject any urls which do not include this secret.
https://cloud.google.com/pubsub/docs/faq#security
This could be configured as part of your normal push endpoint when you set up a push subscription.
If you wish to add extra metadata to the provided gmail messages, you could always set up a cloud dataflow job or cloud function as a subscriber directly from the gmail topic, and republish on a second topic which your external endpoint will read from.
-Daniel
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
Thanks so much Daniel! This is exactly what I needed.
– Richard
Nov 13 '18 at 22:24
add a comment |
The suggested way to do this is to include a secret as a url parameter for your endpoint. You could then reject any urls which do not include this secret.
https://cloud.google.com/pubsub/docs/faq#security
This could be configured as part of your normal push endpoint when you set up a push subscription.
If you wish to add extra metadata to the provided gmail messages, you could always set up a cloud dataflow job or cloud function as a subscriber directly from the gmail topic, and republish on a second topic which your external endpoint will read from.
-Daniel
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
The suggested way to do this is to include a secret as a url parameter for your endpoint. You could then reject any urls which do not include this secret.
https://cloud.google.com/pubsub/docs/faq#security
This could be configured as part of your normal push endpoint when you set up a push subscription.
If you wish to add extra metadata to the provided gmail messages, you could always set up a cloud dataflow job or cloud function as a subscriber directly from the gmail topic, and republish on a second topic which your external endpoint will read from.
-Daniel
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
answered Nov 13 '18 at 19:06
Daniel CollinsDaniel Collins
862
862
Thanks so much Daniel! This is exactly what I needed.
– Richard
Nov 13 '18 at 22:24
add a comment |
Thanks so much Daniel! This is exactly what I needed.
– Richard
Nov 13 '18 at 22:24
Thanks so much Daniel! This is exactly what I needed.
– Richard
Nov 13 '18 at 22:24
Thanks so much Daniel! This is exactly what I needed.
– Richard
Nov 13 '18 at 22:24
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53286736%2fhow-to-verify-that-google-pubsub-is-hitting-my-endpoint-and-not-another-actor%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
