How do you use the Twilio Node SDK to validate webhook requests?

Question

I'm trying to use the Twilio Node SDK with my Express app as per the docs here https://www.twilio.com/docs/usage/tutorials/how-to-secure-your-express-app-by-validating-incoming-twilio-requests in order to validate that requests to my webhook endpoints are in fact coming from Twilio.

I have the TWILIO_AUTH_TOKEN environment variable set in my production environment and have my webhook endpoint defined like so:

router.post(
  "/foo",
  twilio.webhook(),
  async (req, res) => {
    ...
  }

However, when I send an SMS to the Twilio number which triggers the webhook, it returns a 403. From inspecting the debugger in the Twilio console the response body is Twilio Request Validation Failed.

Not too sure what I could be doing wrong here as the docs make it sound fairly straightforward. If I remove the twilio.webhook() line everything works as expected. The webhook endpoint is https, and I have SSL Certificate Validation enabled in my Twilio account.

user3806486 user3806486 · Accepted Answer · 2019-10-16T22:43:01

I ended up getting this to work by just following the steps in the Twilio security guide to generate the hash myself and compare it with the x-twilio-signature header. My only guess is that the Twilio Node SDK is buggy.

How do you use the Twilio Node SDK to validate webhook requests?

2 Answers