NSQL Engine • Webhook Security
HMAC-SHA256 Signed Webhooks & SSRF Defense
When an NSQL filter rule executes `CALL WEBHOOK 'url'`, `nunciod` dispatches an HTTP POST payload verified with cryptographic signatures and strict network safety bounds.
1. Webhook JSON Request Payload Schema
{
"event": "filter_executed",
"rule_id": "rule_vip_01",
"rule_name": "VIP Priority Route",
"message_id": "msg_892317823",
"account": "james.maes@kof22.com",
"sender": "alice@kof22.com",
"subject": "Urgent Architecture Review",
"actions_taken": ["MOVE TO 'vip-inbox'", "CALL WEBHOOK 'https://api.kof22.com/webhook'"],
"matched_at": 1700000000
}2. Code-Level SSRF Security Specifications
- Pre-Flight DNS Blacklist: Blocks `127.0.0.1`, `169.254.169.254` (cloud metadata endpoints), and private subnets (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).
- Zero Redirect Loop (`max_redirects(0)`): Rejects HTTP 301/302 redirects to prevent exfiltration.
- HMAC-SHA256 Signature Header: Requests include `X-Nuncio-Signature` for server payload verification.