Webhook Security & Signatures

Quasar enforces multi-layered outbound security controls to protect both the Quasar infrastructure and external integrator backends.

Because Quasar operates a distributed execution tier dispatching HTTP POST payloads, strict policies govern target host resolution, timeout bounds, and secret rotation.

🛡️ Outbound SSRF (Server-Side Request Forgery) Prevention

To prevent malicious users from targeting internal cloud metadata services, private networks, or loopback interfaces, every webhook dispatch undergoes real-time DNS resolution checks inside the WebhookProcessor:

1. Dual IPv4/IPv6 DNS Resolution: Prior to making an HTTP request, the worker resolves the destination hostname using Node.js DNS promises (resolve4, resolve6, and lookup).
2. Strict IP Range Blacklisting: Quasar validates every resolved IP address against internal private address blocks:
   • Loopback & Unspecified (127.0.0.1, ::1, 0.0.0.0)
   • Private RFC 1918 networks (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0 - 172.31.255.255)
   • Link-local & Cloud Metadata (169.254.0.0/16, fe80::/10)
   • Unique Local IPv6 (fc00::/7, fd00::/8)
3. Execution Block: If any resolved IP falls within a restricted range, delivery is aborted immediately with SSRF Blocked: Internal IP detected without sending an HTTP payload.

⏱️ Connection Timeouts & Tarpit Protection

To prevent “tarpitting” (where a destination endpoint intentionally holds TCP connections open to exhaust worker pool threads), Quasar enforces strict connection parameters:

• Hard Timeout: Dispatches enforce a 10-second timeout (10,000ms). If your server does not return an HTTP response within 10 seconds, the request is destroyed and scheduled for retry.
• Asynchronous Receiver Pattern: Webhook receivers should return an immediate HTTP 200 OK response after verifying signatures, deferring heavy database operations or external API calls to background queues.
• HTTPS Enforcement: In production environments (NODE_ENV=production), webhook URLs must use https://. Unencrypted http:// dispatches are restricted to local development environments.

🔑 Secret Key Rolling & Eviction Propagation

Integrators can rotate (roll) a webhook endpoint’s signing secret (whsec_...) at any time through the Quasar Dashboard:

1. Navigate to Webhooks in the Quasar Dashboard.
2. Select your endpoint and click Roll Secret.
3. Re-authenticate via Step-Up Verification (password and 2FA code).
4. The backend generates a fresh 256-bit whsec_... secret and updates the encrypted secret stored in PostgreSQL.

Edge Propagation: Invalidation of the old signing secret takes effect immediately in the database. Due to distributed Redis cache eviction across edge proxy nodes, allow up to 60 seconds for full cache propagation. Deploy your new secret to your backend environment prior to initiating secret rotation.