How To Disable Artifactory Webhook Validation

Important:

Validation is enabled by default to protect against SSRF attacks. Make sure you understand the risks before disabling it, and consult with your security team if needed.

Overview

Event-based webhooks were introduced in version 7.6.0. This feature is managed by the Event service in JFrog's Unified Platform. The Event service is responsible for distributing webhook events to external systems.

Starting from version 7.11, a webhook's URL is validated during the webhook configuration.

By default, private networks are not allowed to be used as Webhook targets for security reasons and would not pass validation.

In case the webhook URL is invalid, the webhook may not be saved or modified.

When attempting to create or modify an unvalidated webhook, you will encounter the following error entries:

Error Message 1: "Validation Error - unable to validate subscription"

Error Message 2:  “Invalid input: Invalid URL.”

Resolution:

To resolve this, you have two options depending on your Artifactory version and security requirements.

Option 1: Whitelist Specific Domains (Recommended for v7.133.3+)

Starting from Artifactory version 7.133.3, you can also ‘whitelist’ specific domains so they pass the validation. This setting is recommended, as it allows you to maintain the added security of validation while still providing access to the necessary domain.

To add the URL to the whitelist:

1. Open the Artifactory system.yaml file located at $JFROG_HOME/artifactory/etc/system.yaml

2. Add your desired domains or IPs to the whitelist under the event section. You can use domain names (yoursite.com), wildcards (*.site.com), or IP addresses:

   event:
       security:
           blacklist:
               enabled: true
           whitelist:
               - example.com
               - "*.internal.company.com"

3. Perform a full restart of the Artifactory service to apply the changes.

4. Re-test the webhook connection.

Option 2: Disable Validation Entirely (Not Recommended)

If you are on Artifactory version 7.11-7.133.3, or have a specific use case where validation must be bypassed, you can disable the blacklist entirely.

1. Open the Artifactory system.yaml file located at $JFROG_HOME/artifactory/etc/system.yaml.

2. Disable the blacklist by adding the following entry:

   event:
       security:
           blacklist:
               enabled: false

3. Perform a full restart of the Artifactory service.

4. Re-test the webhook connection.

This configuration change allows Artifactory webhooks to successfully trigger external services without being blocked by overly restrictive URL validation.

Logging

In case of issues, you may enable the Event service debugging in the system.yaml file to understand the root cause of it. The change below requires a restart of the Artifactory service.

event:
    logging:
      application:
        level: "debug"