Ask HN: Securely exposing host just to webhooks?
One way, like you say, is to set up a listener on a public network and have it spawn a different event, which gets handed down to your private server through a specificly-punched hole. But there&#x27;s a lot of things to pay attention to: the public listener is fully public and will probably attract all manner of hostile traffic -- DDOS attempts, scans, canned exploit attempts -- which you have to be resilient to, and filter out. And even if you receive a properly authenticated payload from your webhook, you&#x27;re going to want proper input validation (e.g. whitelisting expected values and discarding anything else, so that your lower program isn&#x27;t directly executing unvetted output from the outside).<p>There is tooling that makes some facets easier (e.g. API proxies, which handle in-software rate limiting, authn&#x2F;z), but the inherent complexity of the problem remains.<p>An alternative that comes with much less exposure and much less runaway complexity is to poll from the inside.