Gandalf/sofarr
Public Access
0
0
Fork 0
Code Issues 1 Pull Requests Actions 1 Packages Projects Releases 59 Wiki Activity

BUG: Ombi webhook authentication fails due to custom header requirement #47

New Issue
Closed
opened 2026-05-24 21:15:52 +01:00 by Gandalf · 1 comment
Gandalf commented 2026-05-24 21:15:52 +01:00
Owner
Copy Link
Copy Source

Bug Description

Ombi webhooks are currently failing to authenticate. In server/routes/webhook.js, all /api/webhook/* endpoints (sonarr, radarr, and ombi) require the custom X-Sofarr-Webhook-Secret HTTP header to be present and match the configured SOFARR_WEBHOOK_SECRET.

However, Ombi's built-in Webhook notification agent does not support adding custom HTTP headers to its outgoing webhook notification requests. This makes it impossible for Ombi to successfully authenticate using the current header-only validation mechanism.

Root Cause

In server/routes/webhook.js, validateWebhookSecret(req) only inspects req.get('X-Sofarr-Webhook-Secret'):

function validateWebhookSecret(req) {
  const expectedSecret = getWebhookSecret();
  const providedSecret = req.get('X-Sofarr-Webhook-Secret');
  ...
}

Since Ombi sends standard JSON payloads to a configured URL without custom headers, it cannot supply this header, resulting in a 401 Unauthorized response.

Proposed Remediation

  1. Fallback Authentication Method: Update validateWebhookSecret(req) in server/routes/webhook.js to look for the secret in either the X-Sofarr-Webhook-Secret header OR as a secret query parameter (req.query.secret).
  2. Registration Update: Update the /webhook/enable route in server/routes/ombi.js to automatically append ?secret=${webhookSecret} to the registered webhookUrl sent to Ombi.
  3. OpenAPI Spec & JSDoc Updates: Document the query-parameter fallback authentication option in server/openapi.yaml and the @openapi JSDoc comments in server/routes/webhook.js.
  4. Integration Testing: Add new integration tests in tests/integration/webhook.test.js to assert that authentication via query parameters succeeds, and that invalid query parameters are rejected.
### Bug Description Ombi webhooks are currently failing to authenticate. In `server/routes/webhook.js`, all `/api/webhook/*` endpoints (sonarr, radarr, and ombi) require the custom `X-Sofarr-Webhook-Secret` HTTP header to be present and match the configured `SOFARR_WEBHOOK_SECRET`. However, Ombi's built-in Webhook notification agent does not support adding custom HTTP headers to its outgoing webhook notification requests. This makes it impossible for Ombi to successfully authenticate using the current header-only validation mechanism. ### Root Cause In `server/routes/webhook.js`, `validateWebhookSecret(req)` only inspects `req.get('X-Sofarr-Webhook-Secret')`: ```javascript function validateWebhookSecret(req) { const expectedSecret = getWebhookSecret(); const providedSecret = req.get('X-Sofarr-Webhook-Secret'); ... } ``` Since Ombi sends standard JSON payloads to a configured URL without custom headers, it cannot supply this header, resulting in a `401 Unauthorized` response. ### Proposed Remediation 1. **Fallback Authentication Method**: Update `validateWebhookSecret(req)` in `server/routes/webhook.js` to look for the secret in either the `X-Sofarr-Webhook-Secret` header OR as a `secret` query parameter (`req.query.secret`). 2. **Registration Update**: Update the `/webhook/enable` route in `server/routes/ombi.js` to automatically append `?secret=${webhookSecret}` to the registered `webhookUrl` sent to Ombi. 3. **OpenAPI Spec & JSDoc Updates**: Document the query-parameter fallback authentication option in `server/openapi.yaml` and the `@openapi` JSDoc comments in `server/routes/webhook.js`. 4. **Integration Testing**: Add new integration tests in `tests/integration/webhook.test.js` to assert that authentication via query parameters succeeds, and that invalid query parameters are rejected.
Gandalf added the Kind/Bug
Priority
Critical
1
 labels 2026-05-24 21:15:52 +01:00
Gandalf commented 2026-05-24 21:26:04 +01:00
Author
Owner
Copy Link
Copy Source

Resolved in commit 7b9c895888.

Resolved in commit 7b9c8958886ec3507e7b3b2b98d2c2c59955f906.
Gandalf added the Area/Proxy label 2026-05-28 11:58:28 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Area/Docker
Docker image and container packaging
 Area/Download Clients
Download client integrations
 Area/Frontend
Client-side UI and build tooling
 Area/History
History and completed downloads views
 Area/Logging
Log streaming, file handling, and debug infrastructure
 Area/Matching
Matching and correlation logic
 Area/Proxy
Upstream service proxy routes
 Area/SSE
Server-Sent Events and real-time streaming
 Area/Webhooks
Webhook processing and reliability
 Compat/Breaking
Breaking change that won't be backward compatible
 Compat/Non-Breaking
Non-breaking compatibility change
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label Area/Proxy Kind/Bug
Priority
Critical
1
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Gandalf
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Gandalf/sofarr#47
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?