Build Web PubSub hub configs with event handlers, event listeners, Event Hub integration, and network ACLs.
Build Web PubSub hub configs with event handlers, event listeners, Event Hub integration, network ACLs, and anonymous connect policies.
Required Fields
nameresourceGroupsku.namehubshubs[0].namehubs[0].properties.eventHandlersOutput will appear here...Build an Azure Web PubSub configuration with per-hub eventHandlers (webhook routing for connect/message events) and eventListeners (a newer mechanism piping matched events directly to Event Hub without a webhook round-trip), each hub independently setting anonymousConnectPolicy to deny unauthenticated connections by default. eventHandlers and eventListeners solve genuinely different problems despite both reacting to hub events: eventHandlers is synchronous request/response webhook routing (the handler's response can affect the connection, like rejecting it during the connect event), while eventListeners is fire-and-forget event streaming to Event Hub for downstream processing/analytics, a hub can use both simultaneously for different purposes, as the collaboration hub's config demonstrates.
No, eventListeners is a fire-and-forget mechanism streaming matched events to a destination like Event Hub for downstream consumption, it has no ability to synchronously affect the connection or event processing itself. Only eventHandlers, which uses a synchronous webhook request/response pattern, can actually influence connection acceptance (like rejecting a connect event based on the handler's response).
They serve complementary purposes, as the collaboration hub example shows, eventHandlers handles the synchronous, connection-affecting logic (validating and potentially rejecting connections, processing messages that need a response), while eventListeners simultaneously streams a filtered subset of events to Event Hub for asynchronous downstream processing like analytics or audit logging, without needing the webhook backend to also handle that streaming responsibility.
Best practice, and what the example explicitly configures, is deny, requiring authenticated connections. Always set this explicitly per hub rather than relying on an assumed default, since a hub inadvertently left open to anonymous connections is a real security exposure allowing anyone with the hub's connection URL to establish a WebSocket session without any authentication.
The builder validates that name, resourceGroup, sku.name, hubs, the first hub's name, and its properties.eventHandlers all resolve before accepting the JSON as a valid combined Web PubSub hub configuration; it can't verify the referenced webhook URLs or Event Hub namespace are reachable and correctly authorized, those are only confirmed when real hub events actually attempt delivery.
Explicitly set anonymousConnectPolicy to deny on every hub rather than assuming a safe default, this is a security-relevant setting worth verifying directly rather than trusting platform defaults across every hub in the resource.
Use eventHandlers for anything needing synchronous connection-affecting logic and eventListeners for downstream streaming/analytics, conflating the two (trying to use eventListeners for connection validation, for instance) doesn't work since eventListeners can't affect the connection at all.
Scope eventListeners filters as narrowly as the actual downstream consumer needs, an overly broad userEventPattern floods the Event Hub destination with irrelevant events that the downstream consumer then has to filter out itself.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.