Twilio · api · fg-0167

validateRequest returns false behind a proxy, tunnel or load balancer although the Auth Token is right

Signature check passes locally but fails for every request in production

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Twilio signs the exact public URL it called, including scheme, port and query string, plus the sorted POST parameters. An app that rebuilds the URL from its internal host or http scheme computes a different string; voice callbacks over HTTPS also drop the port, and JSON bodies are covered by a bodySHA256 query parameter instead.

Fix

Build the validation URL from your configured public base URL, not from the incoming Host header. For application/json requests use validateRequestWithBody with the raw body.

Apply

const url = 'https://api.example.com' + req.originalUrl; // public URL Twilio called
const ok = twilio.validateRequest(process.env.TWILIO_AUTH_TOKEN, req.header('X-Twilio-Signature'), url, req.body);
// JSON body: twilio.validateRequestWithBody(token, signature, url, rawBodyString)

Affects: Twilio webhook signature validation for SMS, Voice and Conversations, checked October 2026

Sources

https://www.twilio.com/docs/usage/security

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp