Webrequest

v1.0.6

Run your hook logic out-of-process.

What it is Forwards each hook op as a POST to a URL you run, and relays the reply verbatim.

When to use it You have existing out-of-process hook logic, or want untrusted hook code isolated remotely.

CategoryHook · Gate StatusAvailable

Overview

A hook in busbar 1.5.0 is always a signed, dlopen'd plugin; the retired socket/webhook transports are gone. Webrequest is the first-party bridge back to out-of-process logic: it forwards each hook op (decide/transform/notify/configure/describe/status) as a POST to a URL you run, and returns the capped JSON reply verbatim. Busbar's own hooks::wire normalizers parse that reply; this plugin is a pure network relay, never a second copy of the hook semantics.

It exists for two reasons: migrating existing out-of-process hook logic onto 1.5.0 without a rewrite, and isolating untrusted hook code: the brain runs remotely behind this trusted, signed forwarder, which owns the outbound call.

The forwarder itself is hardened, not just a bare HTTP client: the configured URL is SSRF-guarded at load and reconfigure time (loopback sidecars allowed; link-local, IMDS, RFC1918, CGNAT, and cloud-metadata targets blocked), redirects are disabled on the client so a target can't 30x you to an internal host at runtime, the reply body is size-capped before allocation and depth-guarded before parse, and userinfo is stripped from every error string.

Install it

Download the signed tarball for your platform (button above), drop it in plugins/, define it once under the top-level hooks: map, then reference it by name from pools.<pool>.hooks (one pool) or the all-pools pools.hooks:

# DEFINE once: the name is the instance, `module:` is which plugin backs it.
hooks:
  decide:
    module: busbar-webrequest
    kind: gate
    timeout_ms: 5
    on_error: nothing
    settings: { url: "https://sidecar.internal/decide" }

# REFERENCE by bare name.
pools:
  smart:
    hooks: [decide]
    members: [...]

Independently versioned from busbar itself: pin both explicitly in production. Requires busbar 1.5.0+.

Prefer to install by hand? No plugins.fetch config needed: download the signed tarball (links above), drop it in your plugins.dir, and busbar loads it at boot; signature and trust checks still apply. You can also push it live over the admin API. See the plugin install docs.

Settings

Setting	Required	Default	Description
`url`	Yes	—	HTTPS URL each hook op envelope is POSTed to; SSRF-guarded at load and on every reconfigure.
`timeout_ms`	No	`5000`	Per-op request timeout in milliseconds, clamped to `[1, 5000]`.

← Back to the Plugin Store