Push mechanism: Auth on webhook endpoint

Question

I am curious how auth would work for Push mechanism. It requires an endpoint on the subscriber which has to be accessible over internet so is pubsub client going to validate that message pushed is indeed coming from google? or is that left upto subscribers to implement?

If it is left up-to subscribers what are suggested way to achieve it?

Answer 1

The team is aware that this is not an ideal solution, but for now, the only option is to add a secret token in the push endpoint URL as described at:

https://cloud.google.com/pubsub/faq#security

You can also periodically rotate the secret token for better security. Of course you need to keep the secret token securely.