Twilio Webhook Forgery Is Real: Validate X-Twilio-Signature Before You Trust Any Callback
Anyone who discovers your Twilio webhook URL can forge inbound messages or status callbacks. Validate the X-Twilio-Signature HMAC over the exact public URL and sorted parameters, capture the raw body before middleware consumes it, and deduplicate on MessageSid or CallSid to survive replays.
twilio
nodejs