Payment: add webhook endpoint security: http basic auth verification

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/subscription/SubscriptionWebhookServlet.java

@@ -1,6 +1,7 @@
 package com.sap.sailing.server.gateway.subscription;
 
 import java.io.IOException;
+import java.util.Base64;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
@@ -22,8 +23,15 @@ public class SubscriptionWebhookServlet extends SailingServerHttpServlet {
     private static final long serialVersionUID = 2608645647937414012L;
     private static final Logger logger = Logger.getLogger(SubscriptionWebhookServlet.class.getName());
     
+    private static String basicAuthHeaderValue;
+    
     @Override
     protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        if (!verifyBasicAuth(request)) {
+            response.setStatus(403);
+            return;
+        }
+        
         try {
             Object requestBody = JSONValue.parseWithException(request.getReader());
             JSONObject requestObject = Helpers.toJSONObjectSafe(requestBody);
@@ -135,4 +143,19 @@ public class SubscriptionWebhookServlet extends SailingServerHttpServlet {
         
         return paymentStatus;
     }
+    
+    private boolean verifyBasicAuth(HttpServletRequest request) {
+        String authHeader = request.getHeader("Authorization");
+        if (authHeader == null) {
+            return false;
+        }
+        
+        if (basicAuthHeaderValue == null) {
+            String cred = WebhookBasicAuthConfiguration.getInstance().getUsername() + ":" + WebhookBasicAuthConfiguration.getInstance().getPassword();
+            String base64Hash = Base64.getEncoder().encodeToString(cred.getBytes());
+            basicAuthHeaderValue = "Basic " + base64Hash;
+        }
+        
+        return authHeader.equals(basicAuthHeaderValue);
+    }
 }

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/subscription/WebhookBasicAuthConfiguration.java

@@ -0,0 +1,35 @@
+package com.sap.sailing.server.gateway.subscription;
+
+public class WebhookBasicAuthConfiguration {
+    private static final String USER = "chargebee.basicauthuser";
+    private static final String PASSWORD = "chargebee.basicauthpass";
+    
+    private static WebhookBasicAuthConfiguration instance;
+    
+    private String username;
+    private String password;
+    
+    public static WebhookBasicAuthConfiguration getInstance() {
+        if (instance == null) {
+            instance = new WebhookBasicAuthConfiguration(
+                    System.getProperty(USER),
+                    System.getProperty(PASSWORD)
+                );
+        }
+        
+        return instance;
+    }
+    
+    public WebhookBasicAuthConfiguration(String username, String password) {
+        this.username = username;
+        this.password = password;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+}