Twilio Webhooks, validating the genuine twilio Request

penguin_pam

I am evaluating the Twilio Webhooks for our solution. It works charm. I would like detect and validate that it's Genuine TWILIO call and not a BOT/FAKE, that is making call to our EndPoint (the IPN listener, that URL we specify for Twilio WebHook listener). I don't like the idea of checking UserAgent value contains "TwilioProxy". Do you recommend a better approach?

Originally asked by Cipher sumeet on Stack Exchange (stackoverflow) (CC BY-SA 3.0).

uphilltech

Great question — answering as the UphillTech team:

Twilio developer evangelist here. You can absolutely validate that a webhook is a genuine Twilio request . With every webhook request Twilio sends an X-Twilio-Signature header with a signature in it. The signature is created using the following method: Twilio assembles its request to your application, including the final URL and any POST fields (if the request is a POST). If your request is a POST, Twilio takes all the POST fields, sorts them by alphabetically by their name, and concatenates the parameter name and value to the end of the URL (with no delimiter). Twilio takes the resulting string (the full URL with query string and all POST parameters) and signs it using HMAC-SHA1 and your...

Full answer by philnash: https://stackoverflow.stackexchange.com/a/41483933 (CC BY-SA 3.0).

Need it done for your business? UphillTech.