[Brevo Mailer] Webhook IP Addresses have changed #61062
Conversation
|
Hey! Thanks for your PR. You are targeting branch "6.4" but it seems your PR description refers to branch "6.4 for bug fix". Cheers! Carsonbot |
|
Thank you @richardhj. |
| @@ -37,7 +37,7 @@ protected function getRequestMatcher(): RequestMatcherInterface | |||
| new IsJsonRequestMatcher(), | |||
| // https://developers.brevo.com/docs/how-to-use-webhooks#securing-your-webhooks | |||
| // localhost is added for testing | |||
| new IpsRequestMatcher(['185.107.232.1/24', '1.179.112.1/20', '127.0.0.1']), | |||
| new IpsRequestMatcher(['185.107.232.1/24', '1.179.112.1/20', '172.246.240.1/20', '127.0.0.1']), | |||
There was a problem hiding this comment.
Is the 185.107.232.1/24 range still valid? I cannot find it in the linked document.
There was a problem hiding this comment.
You might be right and we can remove the first one. But I thought they might have legacy services running, so this was the most cautious approach.
There was a problem hiding this comment.
At least in my environment I don't find 185.107.xxx requests
There was a problem hiding this comment.
They did change the IP ranges in their documentation again which is at the time i write this message : 1.179.112.0/20 and 172.246.240.0/20
I did a PR for that #61223
|
Thanks @richardhj , started seeing a few requests from this new IP range this week. Brevo should do better with communication, this change was not announced nor mailed to users. |
So first I recognized multiple
RejectWebhookExceptions. Then I checked my access logs and realized that webhook from Brevo can also come from the '172.246.240.1/20' IP range.This is also documented here: https://help.brevo.com/hc/en-us/articles/15127404548498-Brevo-IP-ranges-List-of-publicly-exposed-services
This new IP range must have been added later this year, it hasn't been there in January, for instance: https://web.archive.org/web/20250125161029/https://help.brevo.com/hc/en-us/articles/15127404548498-Brevo-IP-ranges-List-of-publicly-exposed-services
So this PR adds the new IP range for ingress webhook validation.