Search code examples
dialogflow-esactions-on-googledialogflow-es-fulfillment

Webhook security in dialogflow

We are developing a google action with a fullfilment in a cloud function in GCP. We want to know how is the best way to securize this cloud function:

  1. It is possible use a private cloud function as fullfilment and avoid requests from others origins to dialogflow?
  2. It is possible include a rate limit and quota in our cloud function?
  3. It is possible to limit the number of concurrent request?
  4. Are there some recomendation about certificates or similar?

Thanks!

Solution

  • It is possible use a private cloud function as fullfilment and avoid requests from others origins to dialogflow?

    The short answer is that your fulfillment must be publicly accessible. Your cloud function cannot be private.

    If you want, Dialogflow's Fulfillment section lets you add custom auth or headers. You may be able to use this to only enable requests with this header go through.

    enter image description here

    It is possible include a rate limit and quota in our cloud function? It is possible to limit the number of concurrent request?

    I'm going to suggest not to have any sort of rate limiting. If each request is authentic, you'd end up creating a bad user experience if your fulfillment keeps going down.

    Are there some recomendation about certificates or similar?

    Cloud Functions are all HTTPS by default, so I'm not sure what certificates you'd need or want in this case.