Can't validate webhook
Hi,
We're trying to implement an endpoint to receive Adobe Sign webhooks in a PHP/Symfony application but can't seem to pass the verification process. The registration form always returns "The URL provided is not a valid webhook URL."
Our code looks like this
public function __invoke(Request $request): Response
{
// fetch the header
$adobeClientIdHeader = $request->headers->get('X-AdobeSign-ClientId');
// Compare it with what we expect to receive
// Which is `UB7E5BXCXY` in integration environment
if ($adobeClientIdHeader !== $this->adobeSignClientId) {
return new JsonResponse(null, Response::HTTP_FORBIDDEN);
}
// Return the client id if the method is GET
if ('GET' === $request->getMethod()) {
return new JsonResponse(['xAdobeSignClientId' => $this->adobeSignClientId]);
}
if ('POST' === $request->getMethod()) {
// Handle the webhook...
return new JsonResponse(['xAdobeSignClientId' => $this->adobeSignClientId], 201);
}
// Return a 405 for any other method
throw new MethodNotAllowedHttpException(['POST', 'GET']);
}
We thought it was a problem on our side and tried debugging to the point of just returning the expected integration client id without any other logic, to no avail.
We were even more puzzled to find that configuring a webhook pointing towards a temporary endpoint at https://webhooktest.net would actually work.
We took the request headers Adobe used, which you’ll find below, and fired a cURL request with them toward our own endpoint which answered successfully.
{
accept: application/json,application/json
accept-encoding: gzip, br
cdn-loop: cloudflare; loops=1
cf-connecting-ip: 20.50.247.210
cf-ipcountry: NL
cf-ray: a2554785caaa4b78-AMS
cf-visitor: {"scheme":"https"}
cf-warp-tag-id: a38eb84e-a9a6-4bb7-947c-134ba9de7875
traceparent: 00-f0770e8673e596cce6c78967c9d1b0c6-ec8dc3c7d3295791-00
tracestate: 1322840@nr=0-0-4101566-1656137218-b7add278be706d8f-f8bdbcb9858085b5-0-0.992927-1785759657310
uber-trace-id: e4a0d0dcfe27ab1e7db6c630e0199c96:4ef6d5255e16ee49:0:1
user-agent: AdobeSign
x-adobesign-clientid: UB7E5BXCXY
x-forwarded-for: 20.50.247.210, 172.17.0.1, 10.0.1.13
x-forwarded-host: webhooktest.net
}
Taking a look at our logs, we found out that Adobe Sign never even calls our application. We can see our own calls with cURL but nothing comes up from Adobe.
Are we missing something ?
