How can I protect my Chainlink oracle fulfill method?

Question

Background:

I'm writing a contract that inherits ChainlinkClient in order to make an API request via an oracle job:

function fetch() private returns (bytes32 requestId) {
    Chainlink.Request memory request = buildChainlinkRequest(jobId, address(this), this.fulfill.selector);
    request.add("get", ...);
    return sendChainlinkRequestTo(oracle, request, fee);
}

function fulfill(bytes32 _requestId, uint256 _result) public recordChainlinkFulfillment(_requestId) {
    // Rely on returned data
}

Assumptions:

• When making an oracle request, the fulfill method must be public.
• public methods may be accessed by any other contract.

Question:

What prevents someone manually calling the fulfill method? This is relevant because the contract relies on the data injected in fulfill.

How are contracts secured from injection of invalid data? I expect this question is a result of my own misunderstanding of how oracle interactions work!

Answer 1

Your assumptions are correct, it needs to be public but modifiers can help in this case. ChainlinkClient has recordchainlinkfulfillment modifier for fulfillment callbacks.

This modifier specifies that only the original oracle that was called may call this function, the oracle defined when you send the request.

Reference: chainlink docs