Web Technology Basics
A merchant's server wants to know immediately when a payment is completed on an online payment service. Which of the following correctly describes the method in which the payment service sends a notification by HTTP POST to a URL the merchant registered in advance (a webhook)?
- AThe merchant does not need to ask the payment service at fixed intervals, and notifications arrive only when something changes. Whether a notification is genuine is checked with a signature or similar means
- BThe merchant's server does not need to accept requests from outside, so the URL that receives notifications does not have to be exposed on the internet
- CNotifications arrive over a WebSocket connection opened with a browser, so the merchant's staff must always keep a browser open
Show answer and explanation
Answer: A. The merchant does not need to ask the payment service at fixed intervals, and notifications arrive only when something changes. Whether a notification is genuine is checked with a signature or similar means
With a webhook, the service where an event occurred notifies the receiver by sending an HTTP request to the URL the receiver registered. Compared with the receiver repeatedly asking about the state, there are no wasted requests and changes are learned immediately. In return, the receiver must accept requests arriving from the internet, so it checks whether a notification is genuine, for example with a signature made with a shared secret key. Failed notifications may be resent, so they are processed in such a way that receiving the same notification twice causes no problem.
- A. Correct. Notifications arrive only when something changes, and the sender is verified with a signature or similar means.
- B. Notifications arrive from outside as HTTP requests, so the receiving URL must be exposed.
- C. Webhooks are notifications between servers and do not use browsers or WebSocket.