Webhook订阅验证请求缺失ClientState的技术咨询

Hey there, let's tackle your two questions based on your setup and the behavior you're seeing:

1. Is your ClientState declaration correct? #

Absolutely! Looking at your subscription code, you're setting the ClientState property exactly as expected:

var request = graphClient.Subscriptions.Request(); 
var result = await request.AddAsync( 
    new Subscription { 
        ChangeType = "created,updated,deleted", 
        NotificationUrl = notificationUrl, 
        Resource = "/users/" + userId + "/" + resource, 
        ExpirationDateTime = DateTimeOffset.UtcNow.AddMinutes(4230), 
        ClientState = "my-subscription-identifier" 
    } 
);

The ClientState is a string value you define to uniquely identify the subscription and validate incoming notifications later—your implementation here follows Microsoft Graph's requirements perfectly.

2. Why isn't ClientState present in the validation request? #

This is actually expected behavior from Microsoft Graph's webhook system. Let me clarify:

• The initial validation request (the one with the validationToken in the URL query) serves only one purpose: to confirm that your notification endpoint is valid and under your control. It does not include the ClientState parameter—this is by design.
• The ClientState is intended to be used in actual change notifications (like the updated event you received, which correctly includes your my-subscription-identifier value). This is where you'll use it to verify that the notification is coming from your legitimate subscription, preventing spoofed requests.

Looking at the raw validation request you shared, this is exactly the standard format Microsoft Graph uses for endpoint validation:

POST /?validationToken=NmMwNjE5YjAtNzc3Zi00NmMwLWI1ZmYtYjJiNWI5NzU0MGY5 HTTP/1.1 
Host: localhost:12345 
User-Agent: Go-http-client/1.1 
Content-Length: 0 
Content-Type: text/plain; charset=utf-8 
X-Forwarded-For: 
X-Forwarded-Proto: https 
X-Original-Host: 5a665085.eu.ngrok.io

You only need to extract the validationToken from the query string and return it as the response body to complete the validation. The ClientState check will come into play once the subscription is active and you start receiving real event notifications.

内容的提问来源于stack exchange，提问作者Michael Hufnagel