Validate the call for an iframeURL in a button of the app settigs of a public app

Developer Support APIs & Integrations
1

I’m developing a public app and i want to show a page to fill a form. I configured a button in the app settings that calls an API that returns an iframeURL that is a page I created in HubSpot, sending the portalId as parameter in the request, to know what client is accessing the form. Now, I can validate the call made to the API because of the HubSpot signature but I cannot validate it when the page is showed, how can I validate when the page is called in HubSpot and deny it if is someone opening the URL with a portalId, I’ve looked the headers ended by HubSpot to open the page and there is no a HubSpot signature or something I can use.
Thank you in advance

2

Hi, @danchy. Thanks for your question. You’re right, HubSpot doesn’t provide this functionality by default.

A workaround idea to consider is to use a short-lived, unique token for each request to access the page you’ve embedded in the iframe.

Here’s an outline of the process:

  1. Generate a unique token.
  2. Store the token.
  3. Include the token in the URL.
  4. Validate the token when a request is made.
  5. Check for token expiration.
  6. Deny access if the token is invalid.

Please note that implementing this solution increases the complexity of your app and the load on your server because you’ll need to manage the storage, retrieval, and validation of tokens. Additionally, it’s crucial to follow security best practices for handling this data.

I hope this helps!

Best, Jaycee

3

Thank you for your response, I did it as you said.
Would be great if you could add the HubSpot signature to the iframe too to make it simpler. Also, would be great to implement for a webhook to know when a user uninstalls the app