Twilio SDK Not Validating Signature

[dcaponi]

Hi - Please see details below

The Setup

I'm catching requests from Twilio on a SvelteKit API endpoint. I get the request and all the goodies off of it just fine with the following code

const validateExtractMessage = (url: URL, request: Request): TwilioMessage => {
  const twilio_sig = request.headers.get('x-twilio-signature') ?? '';

  const from = url.searchParams.get('From');
  const text = url.searchParams.get('Body');
  const sms_sid = url.searchParams.get('MessageSid');

  const params: Record<string, string> = {};
  url.searchParams.forEach((value, key) => {
    params[key] = value
  });

  const messageRequestValid = twilio.validateRequest(
    TWILIO_AUTH_CREDENTIAL,
    twilio_sig,
    url.toString(),
    params
  );

  console.log("twilio valid", messageRequestValid)
  return { from, text, sms_sid, twilio_sig, messageRequestValid }
}

The Problem

I've logged out every variable and everything looks correct, and according to all the documentation I could find this seems to be the correct way to validate a signature. I know I have the correct auth credential exported to my environment as I can send texts no problem. The signature is definitely there and all I got from the docs was to send back the url.toString() and params like so.

According to the security docs Im supposed to be sending back like so

const params = {
  CallSid: 'CA1234567890ABCDE',
  Caller: '+12349013030',
  Digits: '1234',
  From: '+12349013030',
  To: '+18005551212',
};

however my requests dont have digits or callers (Is there a messaging centric doc I should be looking at 🤔)? I also noticed a Very subtle callout that these need to be alphabetized?

Then, sort the list of POST variables by the parameter name (using Unix-style case-sensitive sorting order):

What I tried

1. The code you see above
2. Setting the url to be my callback url configured in the portal without trailing slash
3. passing {} for params, alphabetizing params.

If there's a fix or if this is a known issue I'd really appreciate it.

[manisha1997]

Can you please mention the version where you found this bug? With the latest release, we have been introduced a fix for twilio signature validation. https://github.com/twilio/twilio-node/releases/tag/5.4.3

[dcaponi]

Can you please mention the version where you found this bug? With the latest release, we have been introduced a fix for twilio signature validation. https://github.com/twilio/twilio-node/releases/tag/5.4.3

I'm on 5.4.2 so I suppose a bump is required in order to catch your fix.