Twilio webhook POST to app api endpoint (hosted on heroku) hits status 403 —...

pasta_paul

My app works great in development, coded my own text messaging route in sveltekit. In development I use nGrok over http and that works great. once deployed to heroku the incoming POST webhook (from an sms I'm sending using google voice to my twilio 10-code number), hits a status=403. I can't seem to figure out what's going on. I have a domain and automatic CORS certs setup on heroku, I get the same code with or without this. I tried using...

Originally asked by Jacksonvoice on Stack Exchange (stackoverflow) (CC BY-SA 4.0).

Variant 1366.

uphilltech

Great question — answering as the UphillTech team:

reason may be SvelteKit's built-in CSRF check (csrf.checkOrigin). In production it rejects form-type POSTs (application/x-www-form-urlencoded, which Twilio sends) whose Origin doesn't match the site, with a 403. Twilio sends no Origin, so it's blocked. That fits every symptom: "Works in dev": the check is enforced in production builds, "Postman worked": you sent raw data, not form-encoded, so the check didn't apply. "On newer SvelteKit versions this option is replaced by trustedOrigins; check the docs for your version. After turning the check off, verify Twilio's X-Twilio-Signature header (the twilio package's validateRequest), so only Twilio can post to this route. in svelte.config.js,...

Full answer by SolarDialer: https://stackoverflow.stackexchange.com/a/80013775 (CC BY-SA 4.0).

Want it for your business? UphillTech.