AuthyUtil.validateSignatureForPost fails with lower case headers

[rsertelon]

We use this method to verify incoming Authy webhooks, and found out it failed with no apparent reason.

After investigation, we found out the Authy headers were arriving in lower case, which isn't supported by the method as shown by:

        if (!headers.containsKey(HEADER_AUTHY_SIGNATURE))
            throw new OneTouchException("'SIGNATURE' is missing.");

        if (!headers.containsKey(HEADER_AUTHY_SIGNATURE_NONCE))
            throw new OneTouchException("'NONCE' is missing.");

This seems to happen because the Authy server that sends the requests uses HTTP/2 since it is supported by the AWS ALBs (thus the lower case headers).

Deactivating HTTP/2 for this reason is not a solution we could apply. For now we "fix" the headers map before sending it to the library.

[robinske]

This library is no longer actively maintained. The Authy API has been replaced with the Twilio Verify API. Twilio will support the Authy API through November 1, 2022 for SMS/Voice. After this date, we’ll start to deprecate the service for SMS/Voice. Any requests sent to the API after May 1, 2023, will automatically receive an error. Push and TOTP will continue to be supported through July 2023.

Learn more about migrating from Authy to Verify.

Please visit the Twilio Docs for:

• Verify + Java (Servlets) quickstart
• Twilio Java helper library
• Verify API reference

Please direct any questions to Twilio Support. Thank you!