LemonGateway.Sms.TwilioSignature (lemon_gateway v0.1.0)

View Source

Validates Twilio webhook request signatures using HMAC-SHA1.

Computes the expected signature from the auth token, request URL, and POST parameters, then performs a constant-time comparison against the provided X-Twilio-Signature header value.

Summary

Functions

signature(auth_token, url, params)

Compute the Twilio signature for a request.

valid?(auth_token, url, params, provided)

Validate a Twilio webhook request signature.

Functions

signature(auth_token, url, params)

@spec signature(String.t(), String.t(), map()) :: String.t()

Compute the Twilio signature for a request.

The signature is Base64(HMAC-SHA1(auth_token, url <> sorted_params)).

valid?(auth_token, url, params, provided)

@spec valid?(String.t() | nil, String.t() | nil, map() | nil, String.t() | nil) ::
  boolean()

Validate a Twilio webhook request signature.

Returns true when the provided X-Twilio-Signature header matches the expected HMAC-SHA1 digest of the auth_token, url, and POST params. Uses constant-time comparison to mitigate timing attacks.