twilio / twilio-go

A Go package for communicating with the Twilio API.

MIT License

278 stars 40 forks source link

fix: Request validator sorting by key, not keyvalue #140

Closed djeer closed 2 years ago

djeer commented 2 years ago

Fixes

Fixes #139 Fixes bug that some of requests signature were considered wrong

According to docs, in order to validate signature POST form, fields have to be sorted by keys (like in Python twilio library code). However, twilio-go uses "keyvalue" concatenated pairs in sorting which leads to incorrect sorting and invalid signature.

Here is an actual line of golang lib code that sorts keyvalue concatenated chunks https://github.com/twilio/twilio-go/blob/main/client/request_validator.go#L38 Python code that sorts by keys https://github.com/twilio/twilio-python/blob/main/twilio/request_validator.py#L76

beebzz commented 2 years ago

Closing until the requested changes can be made.