Skip to content

Commit 2797466

Browse files
CristhianMotocheCristhianMotoche
authored
Merge pull request #3 from mvazquezrius/webhooks-json-examples
Samples for: Validating webhooks with JSON body
2 parents cd608b9 + 0dc7a56 commit 2797466

17 files changed

+488
-5
lines changed

‎security/signature_validation/signature_validation.10.x.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
import com.twilio.security.RequestValidator;
66

77
public class Example {
8-
public static void main(String[] args) {
9-
// Your Auth Token from twilio.com/user/account
10-
public static final String AUTH_TOKEN = System.getenv("TWILIO_AUTH_TOKEN");
11-
8+
// Your Auth Token from twilio.com/user/account
9+
public static final String AUTH_TOKEN = System.getenv("TWILIO_AUTH_TOKEN");
10+
11+
public static void main(String[] args) throws java.net.URISyntaxException {
1212
// Initialize the request validator
1313
RequestValidator validator = new RequestValidator(AUTH_TOKEN);
1414

‎security/signature_validation_json/meta.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"title": "Validate Signature of Request (application/json body)",
3+
"type": "server"
4+
}

‎security/signature_validation_json/signature_validation_json.1.x.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"os"
6+
7+
"github.com/twilio/twilio-go/client"
8+
)
9+
10+
func main() {
11+
// Your Auth Token from twilio.com/console
12+
authToken := os.Getenv("TWILIO_AUTH_TOKEN")
13+
14+
// Initialize the request validator
15+
requestValidator := client.NewRequestValidator(authToken)
16+
17+
// Store Twilio's request URL (the url of your webhook) as a variable
18+
// including all query parameters
19+
url := "https://example.com/myapp?bodySHA256=5ccde7145dfb8f56479710896586cb9d5911809d83afbe34627818790db0aec9"
20+
21+
// Store the application/json body from Twilio's request as a variable
22+
// In practice, this MUST include all received parameters, not a
23+
// hardcoded list of parameters that you receive today. New parameters
24+
// may be added without notice.
25+
body := []byte("{\"CallSid\":\"CA1234567890ABCDE\",\"Caller\":\"+12349013030\"}")
26+
27+
// Store the X-Twilio-Signature header attached to the request as a variable
28+
signature := "hqeF3G9Hrnv6/R0jOhoYDD2PPUs="
29+
30+
// Check if the incoming signature is valid for your application URL and the incoming parameters
31+
fmt.Println(requestValidator.ValidateBody(url, body, signature))
32+
}

‎security/signature_validation_json/signature_validation_json.10.x.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Install the Java helper library from twilio.com/docs/java/install
2+
import com.twilio.security.RequestValidator;
3+
4+
public class Example {
5+
// Your Auth Token from twilio.com/user/account
6+
public static final String AUTH_TOKEN = System.getenv("TWILIO_AUTH_TOKEN");
7+
8+
public static void main(String[] args) throws java.net.URISyntaxException {
9+
// Initialize the request validator
10+
RequestValidator validator = new RequestValidator(AUTH_TOKEN);
11+
12+
// Store Twilio's request URL (the url of your webhook) as a variable
13+
// including all query parameters
14+
String url = "https://example.com/myapp?bodySHA256=5ccde7145dfb8f56479710896586cb9d5911809d83afbe34627818790db0aec9";
15+
16+
// Store the application/json body from Twilio's request as a variable
17+
// In practice, this MUST include all received parameters, not a
18+
// hardcoded list of parameters that you receive today. New parameters
19+
// may be added without notice.
20+
String body = "{\"CallSid\":\"CA1234567890ABCDE\",\"Caller\":\"+12349013030\"}";
21+
22+
// Store the X-Twilio-Signature header attached to the request as a variable
23+
String twilioSignature = "hqeF3G9Hrnv6/R0jOhoYDD2PPUs=";
24+
25+
// Check if the incoming signature is valid for your application URL and the incoming body
26+
System.out.println(validator.validate(url, body, twilioSignature));
27+
}
28+
}

‎security/signature_validation_json/signature_validation_json.5.x.js‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Get twilio-node from twilio.com/docs/libraries/node
2+
const client = require('twilio');
3+
4+
// Your Auth Token from twilio.com/console
5+
const authToken = process.env.TWILIO_AUTH_TOKEN;
6+
7+
// Store Twilio's request URL (the url of your webhook) as a variable
8+
// including all query parameters
9+
const url = 'https://example.com/myapp?bodySHA256=5ccde7145dfb8f56479710896586cb9d5911809d83afbe34627818790db0aec9';
10+
11+
// Store the application/json body from Twilio's request as a variable
12+
// In practice, this MUST include all received parameters, not a
13+
// hardcoded list of parameters that you receive today. New parameters
14+
// may be added without notice.
15+
const body = "{\"CallSid\":\"CA1234567890ABCDE\",\"Caller\":\"+12349013030\"}";
16+
17+
// Store the X-Twilio-Signature header attached to the request as a variable
18+
const twilioSignature = 'hqeF3G9Hrnv6/R0jOhoYDD2PPUs=';
19+
20+
// Check if the incoming signature is valid for your application URL and the incoming body
21+
console.log(client.validateRequestWithBody(authToken, twilioSignature, url, body));

‎security/signature_validation_json/signature_validation_json.6.x.cs‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Download the twilio-csharp library from
2+
// https://www.twilio.com/docs/libraries/csharp#installation
3+
using System;
4+
using System.Collections.Generic;
5+
using Twilio.Security;
6+
7+
class Example
8+
{
9+
static void Main(string[] args)
10+
{
11+
// Your Auth Token from twilio.com/console
12+
const string authToken = Environment.GetEnvironmentVariable("TWILIO_AUTH_TOKEN");
13+
14+
// Initialize the request validator
15+
var validator = new RequestValidator(authToken);
16+
17+
// Store Twilio's request URL (the url of your webhook) as a variable
18+
// including all query parameters
19+
const string url = "https://example.com/myapp?bodySHA256=5ccde7145dfb8f56479710896586cb9d5911809d83afbe34627818790db0aec9";
20+
21+
// Store the application/json body from Twilio's request as a variable
22+
// In practice, this MUST include all received parameters, not a
23+
// hardcoded list of parameters that you receive today. New parameters
24+
// may be added without notice.
25+
const string body = "{\"CallSid\":\"CA1234567890ABCDE\",\"Caller\":\"+12349013030\"}";
26+
27+
28+
// Store the X-Twilio-Signature header attached to the request as a variable
29+
const string twilioSignature = "hqeF3G9Hrnv6/R0jOhoYDD2PPUs=";
30+
31+
// Check if the incoming signature is valid for your application URL and the incoming body
32+
Console.WriteLine(validator.Validate(url, body, twilioSignature));
33+
}
34+
}

‎security/signature_validation_json/signature_validation_json.7.x.rb‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Get twilio-ruby from twilio.com/docs/ruby/install
2+
require 'rubygems' # This line not needed for ruby > 1.8
3+
require 'twilio-ruby'
4+
5+
# Get your Auth Token from https://www.twilio.com/console
6+
auth_token = ENV['TWILIO_AUTH_TOKEN']
7+
8+
# Initialize the request validator
9+
validator = Twilio::Security::RequestValidator.new(auth_token)
10+
11+
# Store Twilio's request URL (the url of your webhook) as a variable
12+
url = 'https://example.com/myapp?bodySHA256=5ccde7145dfb8f56479710896586cb9d5911809d83afbe34627818790db0aec9'
13+
14+
# Store the application/json body from Twilio's request as a variable
15+
# In practice, this MUST include all received parameters, not a
16+
# hardcoded list of parameters that you receive today. New parameters
17+
# may be added without notice.
18+
body = '{"CallSid":"CA1234567890ABCDE","Caller":"+12349013030"}'
19+
20+
# Store the X-Twilio-Signature header attached to the request as a variable
21+
twilio_signature = 'hqeF3G9Hrnv6/R0jOhoYDD2PPUs='
22+
23+
# Check if the incoming signature is valid for your application URL and the incoming body
24+
puts validator.validate(url, body, twilio_signature)

‎security/signature_validation_json/signature_validation_json.8.x.php‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?php
2+
// NOTE: This example uses the next generation Twilio helper library - for more
3+
// information on how to download and install this version, visit
4+
// https://www.twilio.com/docs/libraries/php
5+
require_once '/path/to/vendor/autoload.php';
6+
7+
use Twilio\Security\RequestValidator;
8+
9+
// Your auth token from twilio.com/user/account
10+
$token = getenv("TWILIO_AUTH_TOKEN");
11+
12+
// The X-Twilio-Signature header - in PHP this should be
13+
// You may be able to use $signature = $_SERVER["HTTP_X_TWILIO_SIGNATURE"];
14+
$signature = 'hqeF3G9Hrnv6/R0jOhoYDD2PPUs=';
15+
16+
// Initialize the request validator
17+
$validator = new RequestValidator($token);
18+
19+
// Store Twilio's request URL (the url of your webhook) as a variable
20+
// including all query parameters
21+
// You may be able to use $url = $_SERVER['SCRIPT_URI']
22+
$url = 'https://example.com/myapp?bodySHA256=5ccde7145dfb8f56479710896586cb9d5911809d83afbe34627818790db0aec9';
23+
24+
// Store the application/json body from Twilio's request as a variable
25+
// In practice, this MUST include all received parameters, not a
26+
// hardcoded list of parameters that you receive today. New parameters
27+
// may be added without notice.
28+
// You may be able to use $body = $_POST
29+
$body = "{\"CallSid\":\"CA1234567890ABCDE\",\"Caller\":\"+12349013030\"}";
30+
31+
// Check if the incoming signature is valid for your application URL and the incoming parameters
32+
if ($validator->validate($signature, $url, $body)) {
33+
echo "Confirmed to have come from Twilio.";
34+
} else {
35+
echo "NOT VALID. It might have been spoofed!";
36+
}

‎security/signature_validation_json/signature_validation_json.9.x.py‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
import os
2+
# Download the twilio-python library from twilio.com/docs/python/install
3+
from twilio.request_validator import RequestValidator
4+
5+
# Your Auth Token from twilio.com/user/account
6+
auth_token = os.environ['TWILIO_AUTH_TOKEN']
7+
8+
# Initialize the request validator
9+
validator = RequestValidator(auth_token)
10+
11+
# Store Twilio's request URL (the url of your webhook) as a variable
12+
# including all query parameters
13+
url = 'https://example.com/myapp?bodySHA256=5ccde7145dfb8f56479710896586cb9d5911809d83afbe34627818790db0aec9'
14+
15+
# Store the application/json body from Twilio's request as a variable
16+
# In practice, this MUST include all received parameters, not a
17+
# hardcoded list of parameters that you receive today. New parameters
18+
# may be added without notice.
19+
body = """{"CallSid":"CA1234567890ABCDE","Caller":"+12349013030"}"""
20+
21+
# Store the X-Twilio-Signature header attached to the request as a variable
22+
twilio_signature = 'hqeF3G9Hrnv6/R0jOhoYDD2PPUs='
23+
24+
# Check if the incoming signature is valid for your application URL and the incoming body
25+
print(validator.validate(url, body, twilio_signature))

‎security/signature_validation_json_tests/meta.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"title": "Test Request Signature Validation (application/json body)",
3+
"type": "server"
4+
}

0 commit comments

Comments
 (0)