Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: verify signature from event webhook #622

Merged
merged 6 commits into from
May 7, 2020
Merged

Conversation

anujs3
Copy link
Contributor

@anujs3 anujs3 commented May 6, 2020

Fixes

When enabling the "Signed Event Webhook Requests" feature in Mail Settings, Twilio SendGrid will generate a private and public key pair using the Elliptic Curve Digital Signature Algorithm (ECDSA). Once that is successfully enabled, all new event posts will have two new headers: X-Twilio-Email-Event-Webhook-Signature and X-Twilio-Email-Event-Webhook-Timestamp, which can be used to validate your events.

This SDK update will make it easier to verify signatures from signed event webhook requests by using the VerifySignature method. Pass in the public key, event payload, signature, and timestamp to validate. Note: You will need to convert your public key string to an elliptic public key object in order to use the VerifySignature method.

I want to give a shoutout to @thavanle for helping me create this new feature. Thanks @thavanle for helping more developers use Twilio SendGrid securely!

Checklist

  • I acknowledge that all my contributions will be made under the project's license.
  • I have made a material change to the repo (functionality, testing, spelling, grammar).
  • I have read the Contribution Guidelines and my PR follows them.
  • I have titled the PR appropriately.
  • I have updated my branch with the master branch.
  • I have added tests that prove my fix is effective or that my feature works.
  • I have added necessary documentation about the functionality in the appropriate .md file
  • I have added in-line documentation to the code I modified.

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.

@thinkingserious thinkingserious added the status: code review request requesting a community code review or review from Twilio label May 6, 2020
@anujs3 anujs3 self-assigned this May 6, 2020
@anujs3 anujs3 force-pushed the signature-verification branch 2 times, most recently from 9abeb5c to 3b87bde Compare May 7, 2020 05:55
@thavanle
Copy link

thavanle commented May 7, 2020

Can we rename the directory "eventsettings" to "eventwebhook" instead please? I know it stutters a little bit for helpers/eventwebhook/EventWebhook.java, but I think it is ok in this context.

@eshanholtz eshanholtz merged commit 2104e0e into master May 7, 2020
@eshanholtz eshanholtz deleted the signature-verification branch May 7, 2020 22:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: code review request requesting a community code review or review from Twilio
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants