Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Supporting GET request signature validation #67

Open
dsamarin opened this issue Jan 16, 2020 · 0 comments
Open

Supporting GET request signature validation #67

dsamarin opened this issue Jan 16, 2020 · 0 comments

Comments

@dsamarin
Copy link

dsamarin commented Jan 16, 2020

According to this code, only POST requests are supported. However, Twilio accesses fax media files using a GET request. As far as I can see and have roughly tested, simply allowing the function to continue even if its a GET request correctly validates the signature.

gotwilio/util.go

Lines 62 to 69 in 06f83df

func (twilio *Twilio) CheckRequestSignature(r *http.Request, baseURL string) (bool, error) {
if r.Method != "POST" {
return false, errors.New("Checking signatures on non-POST requests is not implemented")
}
if err := r.ParseForm(); err != nil {
return false, err
}

Browsing the Twilio documentation, it says that appending the full raw query to the URL is sufficient. Likewise, r.URL.String() includes the entire raw query. Any POST parameters are appended to that. If we call ParseForm on a GET request, the request Body is not read, and r.PostForm is initialized to a non-nil, empty value. So GenerateSignature still functions as it should.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant