title: Authenticating a webhook call in mvc controller http://secretkey:12345@www.example.com
body: <p>Creating a webhook handler in MVC 4 to handle EasyPost webhook calls. I have it all working but now want to add in some authentication.</p>
  
  <p>Easypost suggests a method of including a user name or secret key in the webhook handler url such as: <code>https://username:secret@www.example.com/easypost-webhook</code>  <a href="https://www.easypost.com/webhooks-guide" rel="nofollow noreferrer">reference</a>. Then I presume extracting that secret key value and comparing to an expected value. I'm attempting to do this via regex.</p>
  
  <p>The problem is I cannot find how to retrieve the <code>username:secret@</code> portion of the url in the controller. Tried <code>Request.RawUrl</code> and searched all data in the Request Object, to no avail.</p>
  
  <p>My Code:</p>
  
  <pre><code>public class ParcelShippingWebHooksController : Controller
  {
      [ValidateInput(false)]
      [HttpPost]
      public ActionResult ParcelTrackingWebHookHandler()
      {
          //Authenticate request
          string key = AppSettings.ParcelTrackingWebhookSecretKey;
          string url = Request.RawUrl; &lt;---- how get raw url
          string strPattern = @"secretkey:(.*)\@";
          Match match = Regex.Match(url, strPattern);
          if(!match.Success) return new HttpStatusCodeResult(HttpStatusCode.Forbidden);
          if(match.Value != key) return new HttpStatusCodeResult(HttpStatusCode.Forbidden);
  
          //Convert request to string
          byte[] param = Request.BinaryRead(Request.ContentLength);
          string strWebHookDataRequest = Encoding.ASCII.GetString(param);
  
          //perform tracking updates
          var webhookAppServ = new ParcelShippingWebHooksAppServ(new InventoryMgmtContext());
          var updateTrackingResult = webhookAppServ.UpdateParcelTrackingStatusFromWebHook(strWebHookDataRequest);
  
          if (updateTrackingResult.WasSuccessful)
          {
              return new HttpStatusCodeResult(HttpStatusCode.OK);  // OK = 200
          }
          else
          {
              return new HttpStatusCodeResult(HttpStatusCode.InternalServerError);
          }
      }
  }
  </code></pre>