reviewcomment: add webhook spoofing comment

Co-authored-by: Sam Mesterton-Gibbons <[email protected]>
bbc · May 2, 2024 · 8e531fb · 8e531fb
1 parent 761f2e0
commit 8e531fb
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/api/TimeAddressableMediaStore.yaml b/api/TimeAddressableMediaStore.yaml
@@ -170,7 +170,7 @@ paths:
         of `events` SHOULD update the existing registration. POSTing an empty list of events SHOULD remove the
         registration.
 
-        HTTP requests from the service SHOULD include a `api_key_name` header with the 'api_key_value' value.
+        HTTP requests from the service SHOULD include a `api_key_name` header with the 'api_key_value' value. Clients SHOULD verify this against the value they provided when registering the webhook.
 
         API implementations SHOULD consider the security implementations of providing webhooks, and include appropriate
         mitigations against Server Side Request Forgery (SSRF) attacks and similar.