Securing webhook

TomSchwartzman

It would seem to me that an integromat webhook (for example) is just open to anyone who knows the URL.  I realize it is typically a fairly obscure URL.  But, is there a way to secure it such that it only accepts info from Survey123 and avoid someone just submitting junk? 

One thought is to look at the headers of the incoming request and filter based on something.  Survey123 IP address?  I saw some other product that allows you to append an additional item to the outgoing message, basically a "Security Key" that you could then filter against on the processing side (e.g. integromat).   Is that something Esri might think about implementing? Letting the user add an extra bit of info on the outgoing message to assure it is a valid message coming in?

Thanks for any thoughts.

Tom S.

JamesTedrick

Hi Tom,

As Survey123 uses a client Webhooks, it is not possible to secure based on IP address by default (as submissions could come via the cellular network, a coffee shop's wifi, or a home user's wifi).  If the webhook author is aware of conditions that would restrict the address (such as they know only valid submissions would originate from the organization's internal network), then a restriction based on IP can be put in place.

It is certainly possible for a form submission to have a question answered that a webhook then filters it's processing on, including not processing records that don't meet a condition after the submission has been received.