Subscription FCrDNS Failing

[LifeOmic-Dev]

I'm in the process of switching our Fitbit integration from a polling model to the subscription model.  When implementing FCrDNS, I've noticed that some of the incoming IPs from Fitbit do not have a "fitbit.com" subdomain in the reverse DNS lookup.  I found this thread from about a year ago stating the exact same issue that I'm seeing today, even referencing the same "bc.googleusercontent.com" host.  Has the underlying issue been resolved, or is FCrDNS no longer a valid option for validating incoming requests?

[JohnFitbit]

Hi @LifeOmic-Dev,

Did the workaround provided by Gordon in the thread you referenced not work out for you? The solution should help identify if notifications are coming from Fitbit.

[LifeOmic-Dev]

HI @JohnFitbit.

Gordon had mentioned that some ticket was going to be opened with Google to look into the IP address resolution issue.  I did not see an update in regards to the outcome of that ticket.  The last post he made boiled down to only using the X-Fitbit-Signature header for validation.  While we do have that in place, the FCrDNS check was a nice additional layer of security.  Was I missing some other workaround?

If it is the case that FCrDNS is no longer supported, the security documentation should definitely be updated to not include that as an option.

[Gordon-C · Accepted solution]

Hi @LifeOmic-Dev 

I've updated the original post that you referenced.

It appears GCP doesn’t support masking the IP address such that FCrDNS will report the hostname as a subdomain of fitbit.com.  We do have a recommended method in our documentation for verifying the signature using the X-Fitbit-Signature HTTP header.  This method uses your client secret which is unique to your application.  No one else should have access to your client secret unless your system has been compromised. 

Please review the X-Fitbit-Signature Header section and see if this works for you.  It should be a more secure way to verify the notifications are coming from Fitbit.

https://dev.fitbit.com/build/reference/web-api/subscriptions/#security

We will look at updating the documentation with the new information.