Webhooks: Unique ID for Stream Offline Event

[Dist]

@ceptoplex

I am already using different callback URLs for different streams, that’s basically the only way to differentiate offline stream events right now.

That’s the intended way, so you’re already doing it right.

@ceptoplex

So I assume the only way to prevent this attack is to use non-guessable callback URL paths together with HTTPS to prevent attackers from even seeing the requests and replay them, am I right?

Correct. I don’t believe the spec has anything that would allow for verification of the notification as a whole rather than just the payload, so the only preventative measures you can take are as you mentioned such as obscurity with the URL and using HTTPS (which is required for many topics already)