Allow to pass auth headers to webhook call

[felixmosh]

Is your feature request related to a problem? Please describe.
I want to make sure that the "caller" of a webhook endpoint is a valid caller.

Describe the solution you'd like
I would like to expand the webhook field, so it can be an object with url, headers and any other requests optionsrequests params

Additional context
Passing only the webhook url can expose it to unauthorized access.

[robertpikmets]

I'd also like to emphasize this. Current common approach of passing on the webhook "secret" as a query parameter poses a security risk unfortunately.

[felixmosh]

@robertpikmets , so do you agree with me?
What other options do we have?
What security risk it poses?

[dereoprojects]

query parameters are not well protected and can be looked up via web trackers. I propose asymmetric encryption on this. /run request accepts a public key in the body and the runpod servers will encrypt the actual body with the key provided, and send it in the header. It will also send the actual body. Request owner will use its private key to decrypt. and compare the value to actual body to guarantee authority.

[felixmosh]

Currently, I'm attaching an accessToken (jwt with expiration) to the webhook url...

[felixmosh]

Any update regarding this?