Webhook

Authentication

We recommend always using authentication for your webhooks, such as when calling LogicApps. By this, we mean that there should be no shared access signature or secret put in the url or header, but instead an Entra ID access token should be accepted.

When choosing Entra ID as the authentication type, Fortytwo Universe will present a JWT to your application, for the provided scope. The JWT will vary depending on whether your application is configured to accept v1 or v2 tokens. By default the scope https://management.azure.com/.default is used, which will issue a v1 token.

V1 token example

The important claims you should verify in your receiving end:

V2 token example

The important claims you should verify in your receiving end:

LogicApp authentication example

To configure a LogicApp in the most secure way, follow the below steps:

1. If you have not already done so, consent to the Fortytwo Universe - Workflows application:

https://login.microsoftonline.com/common/adminconsent?client_id=a215ca40-216b-49aa-ac23-f5256a8d6555

2. Deploy our minimum LogicApp to Azure using our template

Skip to step 6.

3. If you chose not to use our template, create your LogicApp using the consumption model.

4. If you chose not to use our template, open the LogicApp, find Authorization, and add the following policy:

This allows the Fortytwo Universe events service to invoke the LogicApp without needing any shared access signature in the url.

5. If you chose not to use our template, add an HTTP trigger

6. Copy the url of the HTTP trigger of the LogicApp

When copying the url of your LogicApp, you will see the three query parameters sp, sv and sig being added. These must be removed (actually, they don't, but we force you to do so in order to be as secure as possible 😉):

https://prod-14.norwayeast.logic.azure.com:443/workflows/ 77cf2d9f2bdf41cb977de860cd601be3/triggers/When_an_HTTP_request_is_received/ paths/invoke?api-version=2016-10-01 &sp=%2Ftriggers%2FWhen_an_HTTP_request_is_received%2Frun&sv=1.0 &sig=c55rRC959lDdI7XcKthSyY9LIQ2dm-dhvfBggG2f-tg

6. Last, when configuring a workflow, use the modified URL and remember to verify that the webhook works, and that the LogicApp is indeed triggered:

Authentication deep dive example

In this example we will use https://webhooktest.net/ in order to demonstrate what you receive in the authorization header.

1. Create a new endpoint in the webhook tester:

2. Create an app registration in Entra ID

3. Under Expose an API, add an Application ID URI. You can use the default, or something with a domain name:

In this example, we chose the default api://93eae805-6c8e-43a1-9238-9172cb625943, which means that the scope we will be requesting a token for is api://93eae805-6c8e-43a1-9238-9172cb625943/.default.

4. Go to your webhook configuration in Fortytwo Universe and paste your url from webhooktest.net, choose Entra ID for authentication, insert the scope of your app and click Test webhook:

5. In webhooktest.net, we can now see that the webhook was called with an authorization header, which we can use https://jwt.ms to decode:

6. You'll notice that by default, the ver claim is 1.0, meaning we have a v1 token. In order to switch to a v2 token, we can configure the app registration manifest:

7. After the update, you may have to wait for 1 hour until the cache of Fortytwo Universe expires, before a new Test webhook. After this, we can see the verof the token updated to 2.0: