How to check if HTTP POST came from SendGrid servers?

Edit Subject

Is there a way to know for sure that HTTP POST sent by SendGrid for each incoming email is genuinely sent from SendGrid servers, and not some other, potentially malicious, server?

6 people have
this question +1

EMPLOYEE

2

Edit

Delete

Remove

Official

David Williams (Employee) March 10, 2011 19:55

you can use https & basic auth in your event url.

so if your event url looked like this:
https://username:password@example.com...

& you had the username & password setup in your server's htpasswd (or equivalent). all event posts to your site would be as secure as the password. Be sure to check your logs to make sure events are still being accepted after making the change

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

you can use https & <a href=http://en.wikipedia.org/wiki/Basic_access_authentication>basic auth</a> in your event url. so if your event url looked like this: https://username:password@example.com/post/here & you had the username & password setup in your server's htpasswd (or equivalent). all event posts to your site would be as secure as the password. Be sure to check your logs to make sure events are still being accepted after making the change

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
I’m thankful

0

Edit

Delete

Remove

Official

nnc March 10, 2011 20:01

Thanks, that's good idea.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Thanks, that's good idea.

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

David Haddad April 20, 2011 07:54

Hey David, any other solutions in case your server does not have htpasswd or equivalent? I.e. Google App Engine

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Hey David, any other solutions in case your server does not have htpasswd or equivalent? I.e. Google App Engine

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
EMPLOYEE

1

Edit

Delete

Remove

Official

David Williams (Employee) April 20, 2011 16:31

I'm not usually a fan of security through obscurity, but something like this:

https://example.com/some/really/long/...

should be sufficient if you're looking keep random people from posting events. Assuming of course the path isn't published or linked to from anywhere.

Is this a real problem people are seeing, or is this only to stop a theoretical attack? If this is a real problem, I can put in a feature request to either use client certificates or cryptographically sign the posted parameters. It would provide strong verification that the post came from us, but would be more work on your side to setup/verify the message

good answer! good answer! (undo)
- view -1 more comments
- David Haddad April 20, 2011 18:43
  
  Thanks David. I was thinking of this as a preventive measure.
  
  Edit
  
  Delete
  
  Remove
- Cancel
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

I'm not usually a fan of security through obscurity, but something like this: https://example.com/some/really/long/and/impossible/to/guess/path should be sufficient if you're looking keep random people from posting events. Assuming of course the path isn't published or linked to from anywhere. Is this a real problem people are seeing, or is this only to stop a theoretical attack? If this is a real problem, I can put in a feature request to either use client certificates or cryptographically sign the posted parameters. It would provide strong verification that the post came from us, but would be more work on your side to setup/verify the message

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

alexandrigo April 28, 2011 19:02

Hi David, but it seems that you doesn't support basic auth. We tried it and we always had got 401 response, because there isn't provided username and password.
We asked support about this, and they answered "We do not presently support the standard basic auth protocol...", is it true?

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Hi David, but it seems that you doesn't support basic auth. We tried it and we always had got 401 response, because there isn't provided username and password. We asked support about this, and they answered "We do not presently support the standard basic auth protocol...", is it true?

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
EMPLOYEE

0

Edit

Delete

Remove

Official

David Williams (Employee) April 29, 2011 20:49

The people in support are right, the http client we're using is pretty stripped down and doesn't support http auth or SSL. Sorry for the bad info.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

The people in support are right, the http client we're using is pretty stripped down and doesn't support http auth or SSL. Sorry for the bad info.

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

Tagggly™ May 20, 2011 22:37

You need to do a hmac sig header. Again, bad security from sendgrid.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

You need to do a hmac sig header. Again, bad security from sendgrid.

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

Amit Saxena June 03, 2011 07:08

Any updates on this? What methods are the people using to verify if the POST came from sendgrid? The method described in first post is not possible because sendgrid generates the url and doesn't pass the authentication details, or am I missing something.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Any updates on this? What methods are the people using to verify if the POST came from sendgrid? The method described in first post is not possible because sendgrid generates the url and doesn't pass the authentication details, or am I missing something.

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

alexandrigo June 03, 2011 07:40

Filter by ip. Allow request only for sendgrid ip-s.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Filter by ip. Allow request only for sendgrid ip-s.

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

Amit Saxena June 03, 2011 08:01

Do we have a list of ip-s?
Also there would be issues in case new machines are added. We should receive notification from sendgrid in that case so that we can keep the list updated.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Do we have a list of ip-s? Also there would be issues in case new machines are added. We should receive notification from sendgrid in that case so that we can keep the list updated.

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

alexandrigo June 03, 2011 08:27

My ip list:
50.22.57.66
50.22.57.67
50.22.57.68
50.22.57.69
50.22.57.70

Response from support:
"These IPs should be fine to allow posting. Let me know if you run into any problems where the information is not getting through."

Next my question:
"So if I get it right this list of IPs should not be changed unexpectedly in future. Can I expect a warning beforehand if you'll going to make any changes to this list?"

Response:
"These should not change anytime soon.
If you run into any problems with posting, please contact us and let us know."

That's all...

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

My ip list: 50.22.57.66 50.22.57.67 50.22.57.68 50.22.57.69 50.22.57.70 Response from support: "These IPs should be fine to allow posting. Let me know if you run into any problems where the information is not getting through." Next my question: "So if I get it right this list of IPs should not be changed unexpectedly in future. Can I expect a warning beforehand if you'll going to make any changes to this list?" Response: "These should not change anytime soon. If you run into any problems with posting, please contact us and let us know." That's all...

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
0

Edit

Delete

Remove

Official

Daryl Puryear December 07, 2011 04:33

Supporting the basic auth protocol would really help. We have a testing environment that is not public and is protected by basic auth. It would make testing much easier if we could include basic auth credentials in the callback url.

The documentation also incorrectly states that it is supported. See the note halfway down the page: http://docs.sendgrid.com/documentatio...

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Supporting the basic auth protocol would really help. We have a testing environment that is not public and is protected by basic auth. It would make testing much easier if we could include basic auth credentials in the callback url. The documentation also incorrectly states that it is supported. See the note halfway down the page: http://docs.sendgrid.com/documentation/api/event-api/

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
I’m frustrated

0

Edit

Delete

Remove

Official

shaun.dishman December 09, 2011 20:38

Glad I found this thread - I've been racking my brain over here for the last few hours wondering why the HTTP Auth params I've been sending in my event notification URL aren't being sent back to me right.

The most frustrating part is not necessarily that it's not there, but more that the documentation says it is, when apparently it's not. Having this feature would be a very big value-add for us.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

Glad I found this thread - I've been racking my brain over here for the last few hours wondering why the HTTP Auth params I've been sending in my event notification URL aren't being sent back to me right. The most frustrating part is not necessarily that it's not there, but more that the documentation says it is, when apparently it's not. Having this feature would be a very big value-add for us.

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel
EMPLOYEE

0

Edit

Delete

Remove

Official

Jacob (Support Engineer) January 13, 2012 18:55

To clarify this after extensive testing on my part:

At this time, we do not support HTTP Authorization, though we do support HTTPS connections.

Comment

good answer! good answer! (undo)
- Cancel
Edit Your Reply (some HTML allowed)
What's the status of this question?

To clarify this after extensive testing on my part: <a href="http://docs.sendgrid.com/documentation/api/event-api/">At this time, we do not support HTTP Authorization, though we do support HTTPS connections.</a>

How does this make you feel? Add Image

I'm
e.g. indifferent, undecided, unconcerned sad, anxious, confused, frustrated happy, confident, thankful, excited kidding, amused, unsure, silly
Cancel