{
  "url": "https://api.example.com/data",
  "headers": {
    "Authorization": "Bearer {{ $env.API_KEY }}"
  }
}

{
  "authentication": "basicAuth",
  "user": "webhook_user",
  "password": "{{ $env.WEBHOOK_PASSWORD }}"
}

{
  "authentication": "headerAuth",
  "name": "X-API-Key",
  "value": "{{ $env.WEBHOOK_API_KEY }}"
}

{
  "authentication": "bearerToken",
  "token": "{{ $env.WEBHOOK_BEARER_TOKEN }}"
}

{
  "authentication": "jwtAuth",
  "secret": "{{ $env.JWT_SECRET }}",
  "algorithm": "HS256",
  "issuer": "your-app",
  "audience": "webhook-receiver"
}

const crypto = require('crypto');

const secret = $env.WEBHOOK_SECRET;
const signature = $headers['x-signature'];
const body = JSON.stringify($json);

const expectedSignature = crypto
  .createHmac('sha256', secret)
  .update(body)
  .digest('hex');

if (signature !== expectedSignature) {
  throw new Error('Invalid signature');
}

return [{ json: { valid: true } }];

const allowedIPs = ['192.168.1.100', '10.0.0.50'];
const clientIP = $headers['x-forwarded-for'] || $headers['x-real-ip'];

{{ allowedIPs.includes(clientIP) }}

const rateLimit = 100; // Requests pro Minute
const currentCount = $workflow.staticData.requestCount || 0;
const lastReset = $workflow.staticData.lastReset || Date.now();

// Reset nach 1 Minute
if (Date.now() - lastReset > 60000) {
  $workflow.staticData.requestCount = 0;
  $workflow.staticData.lastReset = Date.now();
}

if (currentCount >= rateLimit) {
  throw new Error('Rate limit exceeded');
}

$workflow.staticData.requestCount = currentCount + 1;

const requestTime = parseInt($headers['x-timestamp']);
const currentTime = Date.now();
const maxAge = 5 * 60 * 1000; // 5 Minuten

{{ Math.abs(currentTime - requestTime) < maxAge }}

const nonce = $headers['x-nonce'];
const seenNonces = $workflow.staticData.seenNonces || [];

if (seenNonces.includes(nonce)) {
  throw new Error('Duplicate request');
}

seenNonces.push(nonce);
$workflow.staticData.seenNonces = seenNonces.slice(-1000);