Hmmbob
September 30, 2022, 4:49pm
1
Webhooks only support POST. It would be great to finally have GET support for webhook triggers, as this would greatly expand the possibilities for use.
PHLAK
October 7, 2022, 7:25pm
2
Webhooks should ideally support any HTTP method (e.g. GET, POST, DELETE, etc) and allow us to choose one or more of the acceptable methods for the request.
1 Like
True! I ran into this issue recently. It would make some setups a bit easier. It would also make testing easier.
1 Like
Hmmbob
October 9, 2022, 1:00pm
4
There’s a ready-for-review PR fixing this WTH issue:
home-assistant:dev ← esev:webhook_trigger_opts
opened 01:20AM - 14 Feb 22 UTC
<!--
You are amazing! Thanks for contributing to our project!
Please, DO N… OT DELETE ANY TEXT from this template! (unless instructed).
-->
## Breaking change
<!--
If your PR contains a breaking change for existing users, it is important
to tell them what breaks, how to make it work again and why we did this.
This piece of text is published with the release notes, so it helps if you
write it towards our users, not us.
Note: Remove this section if this PR is NOT a breaking change.
-->
Two new Webhook trigger options have been added that limit how a webhook can be used to trigger an automation. A new _allowed_methods_ option can be used to control which HTTP request methods can activate the trigger (GET, HEAD, POST, PUT). And the _local_only_ option is used allow devices outside your local network to activate the trigger.
Previously all webhook triggers could be activated by HEAD, POST, and PUT methods from any device (local or on the internet). With the new options, only POST and PUT are enabled by default.
**In Home Assistant version 2023.1.0 any webhook trigger that does not set _local_only_ to false can only be activated by devices on the same network as Home Assistant.**
To update your webhook triggers, click the gear/cog icon beside the Webhook ID. Then select an appropriate value for _Only accessible from the local network_. It is necessary to deselect the option for the 'Save' button to appear. Then reselect the option if it should be enabled. This will make the repair warning go away.
See the [webhook trigger documentation](https://www.home-assistant.io/docs/automation/trigger/#webhook-trigger) for a description of the new options. And please review the new the [Webhook Security](https://www.home-assistant.io/docs/automation/trigger/#webhook-security) section for best practices when using webhook triggers.
## Proposed change
<!--
Describe the big picture of your changes here to communicate to the
maintainers why we should accept this pull request. If it fixes a bug
or resolves a feature request, be sure to link to that issue in the
additional information section.
-->
This PR adds two new options for webhook triggers:
1. __allowed_methods__: Controls which methods can be used with a webhook trigger. Allowed methods include GET, HEAD, POST, and PUT. By default only POST and PUT are enabled. Methods that are not enabled will return 200 OK to the caller, but will not trigger the webhook; they will cause a log message to be generated though.
2. __local_only__: Controls whether the webhook trigger can be accessed by devices on the internet. A log message will be generated for access attempts from the internet when this option is enabled. This option is ignored for webhook triggers that are activated via Nabu Casa Cloud or via the websocket API.
See #56446 & #65928 for a discussion on the security implications of this change.
## Type of change
<!--
What type of change does your PR introduce to Home Assistant?
NOTE: Please, check only 1! box!
If your PR requires multiple boxes to be checked, you'll most likely need to
split it into multiple PRs. This makes things easier and faster to code review.
-->
- [ ] Dependency upgrade
- [ ] Bugfix (non-breaking change which fixes an issue)
- [ ] New integration (thank you!)
- [ ] New feature (which adds functionality to an existing integration)
- [x] Breaking change (fix/feature causing existing functionality to break)
- [ ] Code quality improvements to existing code or addition of tests
## Example entry for `configuration.yaml`:
<!--
Supplying a configuration snippet, makes it easier for a maintainer to test
your PR. Furthermore, for new integrations, it gives an impression of how
the configuration would look like.
Note: Remove this section if this PR does not have an example entry.
-->
```yaml
automation:
trigger:
- platform: webhook
webhook_id: "some_hook_id"
allowed_methods:
- POST
- PUT
local_only: true
```
## Additional information
<!--
Details are important, and help maintainers processing your PR.
Please be sure to fill out additional details, if applicable.
-->
- This PR fixes or closes issue: fixes #65348
- This PR is related to issue: #56446
- Link to documentation pull request: https://github.com/home-assistant/home-assistant.io/pull/21637
- Link to the frontend pull request: https://github.com/home-assistant/frontend/pull/11680
## Checklist
<!--
Put an `x` in the boxes that apply. You can also fill these out after
creating the PR. If you're unsure about any of them, don't hesitate to ask.
We're here to help! This is simply a reminder of what we are going to look
for before merging your code.
-->
- [x] The code change is tested and works locally.
- [x] Local tests pass. **Your PR cannot be merged unless tests pass**
- [x] There is no commented out code in this PR.
- [x] I have followed the [development checklist][dev-checklist]
- [x] The code has been formatted using Black (`black --fast homeassistant tests`)
- [x] Tests have been added to verify that the new code works.
If user exposed functionality or configuration variables are added/changed:
- [ ] Documentation added/updated for [www.home-assistant.io][docs-repository]
If the code communicates with devices, web services, or third-party tools:
- [ ] The [manifest file][manifest-docs] has all fields filled out correctly.
Updated and included derived files by running: `python3 -m script.hassfest`.
- [ ] New or updated dependencies have been added to `requirements_all.txt`.
Updated by running `python3 -m script.gen_requirements_all`.
- [ ] For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.
- [ ] Untested files have been added to `.coveragerc`.
The integration reached or maintains the following [Integration Quality Scale][quality-scale]:
<!--
The Integration Quality Scale scores an integration on the code quality
and user experience. Each level of the quality scale consists of a list
of requirements. We highly recommend getting your integration scored!
-->
- [ ] No score or internal
- [ ] 🥈 Silver
- [ ] 🥇 Gold
- [ ] 🏆 Platinum
<!--
This project is very active and we have a high turnover of pull requests.
Unfortunately, the number of incoming pull requests is higher than what our
reviewers can review and merge so there is a long backlog of pull requests
waiting for review. You can help here!
By reviewing another pull request, you will help raise the code quality of
that pull request and the final review will be faster. This way the general
pace of pull request reviews will go up and your wait time will go down.
When picking a pull request to review, try to choose one that hasn't yet
been reviewed.
Thanks for helping out!
-->
To help with the load of incoming pull requests:
- [ ] I have reviewed two other [open pull requests][prs] in this repository.
[prs]: https://github.com/home-assistant/core/pulls?q=is%3Aopen+is%3Apr+-author%3A%40me+-draft%3Atrue+-label%3Awaiting-for-upstream+sort%3Acreated-desc+review%3Anone+-status%3Afailure
<!--
Thank you for contributing <3
Below, some useful links you could explore:
-->
[dev-checklist]: https://developers.home-assistant.io/docs/en/development_checklist.html
[manifest-docs]: https://developers.home-assistant.io/docs/en/creating_integration_manifest.html
[quality-scale]: https://developers.home-assistant.io/docs/en/next/integration_quality_scale_index.html
[docs-repository]: https://github.com/home-assistant/home-assistant.io
1 Like
esev
October 10, 2022, 8:45pm
5
I’m the author of that PR. Please let me know if there is anything I can do to help, or if you have additional related feature requests.
4 Likes