I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me thinking: I am validating that the webhook url is indeed a valid url, but that's it.
What if, for example, the API posts to a webhook that redirects forever? Or, maybe even worse, a webhook that in turn communicates with the API again, triggering more webhooks, so that eventually the API has to handle an infinite amount of webhooks?
These are just two examples, but I guess a lot more could happen.
The one thing I have come up with is to put all posts to webhooks in background tasks, so that at least the workload is distributed to workers, in case someone tries a DOS attack (but then again, I am not sure if that properly protects me from DOS attacks).
Are there any other common threats/pitfalls when using webhooks? What can I do to defend against harmful webhooks and how can I detect them?