Workflows Best Practices

Check signatures for Make HTTPS Request steps

Whenever you use a Make HTTPS Request step, you should configure the step to provide a Persona-Signature header with an HMAC for all POST requests. You can use this header to check that a request is authentic (i.e. it originates from Persona) and thus is safe to process. Compare this HMAC value with your own digest computed from the request body and a configurable secret value.

You can configure the secret value by expanding the Advanced Configuration setting when creating a new Make HTTPS Request step.

The Persona-Signature header contains two comma-separated key-value pairs encoding information about the request. The first key-value pair will be in the form t=<unix_timestamp> and represents the unix time that the request was sent. The second key-value pair will be in the form v1=<signature>, where the signature is computed from the configured secret value and a dot-separated string composed of the unix timestamp joined with the request body.

Sample code for checking signatures:

1
t, v1 = request.headers['Persona-Signature'].split(',').map { |value| value.split('=').second }
2
computed_digest = OpenSSL::HMAC.hexdigest('SHA256', <YOUR_WORKFLOW_STEP_SECRET>, "#{t}.#{request.body.read}")
3
4
if v1 == computed_digest
5
  # Handle verified webhook event
6
end

Use Wait steps for shorter waits

Wait steps can result in workflow runs that take a long time to process. In order to prevent long running workflow runs, wait steps have a 30 day limit for their resolution time.

1. Wait on objects: If the event(s) being waited on for the object do not occur within 30 days, the wait step will automatically resolve.
2. Wait for time: The maximum amount of time allowed is 30 days.

Learn more

See Workflow Best Practices in our Help Center for more tips.