CODEWITHSUNDEEP
pythondjangosendgrid
Miguel Herreros Cejas
Miguel Herreros Cejas

Reputation: 674

Verifying SendGrid's Signed Event Webhook in Django

I am trying to get signed from sengrid Webhook:

https://docs.sendgrid.com/for-developers/tracking-events/getting-started-event-webhook-security-features

from sendgrid.helpers.eventwebhook import EventWebhook, EventWebhookHeader

def is_valid_signature(request):

#event_webhook_signature=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_SIGNATURE']
#event_webhook_timestamp=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_TIMESTAMP']

   event_webhook = EventWebhook()
   key=settings.SENDGRID_HEADER


    ec_public_key = event_webhook.convert_public_key_to_ecdsa(key)

   text=json.dumps(str(request.body))

   return event_webhook.verify_signature(
      text,
      request.headers[EventWebhookHeader.SIGNATURE],
      request.headers[EventWebhookHeader.TIMESTAMP],
      ec_public_key
  )

When I send test example from sengrid, always return False. I compared keys and all is correct, so, I think that the problem is the sintax of the payload:

 "b[{\"email\":\"[email protected]\",\"timestamp\":1648560198,\"smtp-id\":\"\\\\u003c14c5d75ce93.dfd.64b469@ismtpd-555\\\\u003e\",\"event\":\"processed\",\"category\":[\"cat facts\"],\"sg_event_id\":\"G6NRn4zC5sGxoV2Hoz7gpw==\",\"sg_message_id\":\"14c5d75ce93.dfd.64b469.filter0001.16648.5515E0B88.0\"},{other tests},\\r\\n]\\r\\n"

Upvotes: 1

Views: 1020

Answers (3)

Bencho Naut
Bencho Naut

Reputation: 348

( not failing on missing headers , utf8 decoding , types converted to strings)

def flask_verifySendgridSignedWebhook(myrequest ,  expectedKey ):
    try:
        if(myrequest.is_json):
            sg_verify=EventWebhook()
            msgbody=""
            #print("JSON FOUND")
            if(myrequest.data):
                msgbody=myrequest.get_data().decode('utf-8')
            ##print(msgbody) 
            if(sg_verify.verify_signature(  msgbody , str( myrequest.headers.get(EventWebhookHeader.SIGNATURE)),
                                                      str( myrequest.headers.get(EventWebhookHeader.TIMESTAMP)),
                                                      sg_verify.convert_public_key_to_ecdsa(expectedKey)     )):
                return True
        else:
             #print("NO JSON SENT")
             return False
    except:
        return False

Upvotes: 3

Miguel Herreros Cejas
Miguel Herreros Cejas

Reputation: 674

I found the solution, my function is now like this:

def is_valid_signature(request):

#event_webhook_signature=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_SIGNATURE']
#event_webhook_timestamp=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_TIMESTAMP']

event_webhook = EventWebhook()
key=settings.SENDGRID_HEADER


ec_public_key = event_webhook.convert_public_key_to_ecdsa(key)
    

return event_webhook.verify_signature(
    request.body.decode('latin-1'),
    request.headers[EventWebhookHeader.SIGNATURE],
    request.headers[EventWebhookHeader.TIMESTAMP],
    ec_public_key
)

I had to decode in Latin-1, because we have my codification in UTF-8.

Thanks

Upvotes: 1

philnash
philnash

Reputation: 73075

I think the issue is that you are calling:

text = json.dumps(str(request.body))

json.dumps serializes an object to a JSON formatted string, but str(request.body) is already a string.

Try just

text = str(request.body)

Upvotes: 1

Related Questions