Blog25.3K views844 votes0 replies4,095 following
Twilio Webhook Forgery Is Real: Validate X-Twilio-Signature Before You Trust Any Callback
Anyone who discovers your Twilio webhook URL can forge inbound messages or status callbacks. Validate the X-Twilio-Signature HMAC over the exact public URL and sorted parameters, capture the raw body before middleware consumes it, and deduplicate on MessageSid or CallSid to survive replays.
twilio
nodejs