NSQL Engine • Webhook Security
Outbound Signed Webhooks & SSRF Defense
An NSQL rule's CALL WEBHOOK 'url' action dispatches through crates/nuncio-filter/src/webhook.rs: an HMAC-SHA256-signed HTTP POST with SSRF defenses on the target URL. The dispatcher itself is implemented and tested.
1. Webhook JSON Request Payload Shape
{
"event": "filter_executed",
"rule_id": "rule_vip_01",
"rule_name": "VIP Priority Route",
"message_id": "msg_892317823",
"account": "you@example.com",
"sender": "alerts@example-crm.com",
"subject": "Urgent Architecture Review",
"actions_taken": ["MOVE TO 'vip-inbox'", "CALL WEBHOOK 'https://api.example.com/webhook'"],
"matched_at": 1700000000
}2. SSRF Defenses in the Dispatcher
- Pre-flight DNS blocking: rejects
127.0.0.1,169.254.169.254(cloud metadata endpoints), and private subnets (10.0.0.0/8,172.16.0.0/12,192.168.0.0/16). - Zero redirect loop: rejects HTTP 301/302 redirects to prevent exfiltration.
- HMAC-SHA256 signature header: requests carry an
X-Nuncio-Signatureheader for the receiver to verify.
This is a real, tested piece of the engine — but because the filter match-and-act engine isn't yet wired into the live mail-sync path, no webhook fires automatically against your inbox today. It fires only when explicitly invoked in tests or once that wiring lands.