paypal webhook key

src/Billing/BillingSettings.cs

@@ -14,6 +14,7 @@
             public virtual string ClientId { get; set; }
             public virtual string ClientSecret { get; set; }
             public virtual string WebhookId { get; set; }
+            public virtual string WebhookKey { get; set; }
         }
     }
 }

src/Billing/Controllers/PayPalController.cs

@@ -31,6 +31,11 @@ namespace Bit.Billing.Controllers
         [HttpPost("webhook")]
         public async Task<IActionResult> PostWebhook([FromQuery] string key)
         {
+            if(key != _billingSettings.PayPal.WebhookKey)
+            {
+                return new BadRequestResult();
+            }
+
             if(HttpContext?.Request == null)
             {
                 return new BadRequestResult();

src/Billing/appsettings.json

@@ -62,7 +62,8 @@
       "production": false,
       "clientId": "SECRET",
       "clientSecret": "SECRET",
-      "webhookId": "SECRET"
+      "webhookId": "SECRET",
+      "webhookKey": "SECRET"
     }
   }
 }