Twilio HTTP Authentication for programmable sms status callback urls

user_1624368 0
Viewed 414

I want to use HTTP basic authentication to password protect the status callback endpoint for programmable sms. On the initial request from Twilio, which does not have a Authorization header, I send back a status code of 401 with the WWW-Authenticate header set to "Basic realm='some realm'". However I do not receive a following request from Twilio with Authorization header.

refer: https://www.twilio.com/docs/usage/security#http-authentication

// Send sms with status callback

 const details = await client.messages
  .create({
     body: 'This is the ship that made the Kessel Run in fourteen parsecs?',
     from: 'TEST',
     to: '......',
     statusCallback: `https://user123:pass123@foo.com/status`
   })

// Lambda response headers from logs

Method response headers: {WWW-Authenticate=Basic realm='Validate twilio request', Content-Type=application/xml}

Note: The reason as to why basic authentication is needed is to validate the authenticity of the request using the provided username and password. I am not using the X-Twilio-Signature HTTP header as I do not have access to the auth token to validate the request and am using api keys to make requests.

twilio-api twilio basic-authentication http-authentication
2 Answers

I tested with Ngrok (w/authentication enabled) with Twilio statusCallback basic authentication configured and it works. Try modifying your response headers to see if that changes anything.

Ngrok returns the below response headers:

HTTP/1.1 401 Unauthorized
Content-Length: 20
Content-Type: text/plain
Www-Authenticate: Basic realm="ngrok"
user_97500660

@Alan's answer lead me to investigate further on the headers returned by API Gateway. The 'WWW-Authenticate' headers that the lambda returned had been remapped by API Gateway (learn more here: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-known-issues.html)

The solution was to implement a lambda authorizer to intercept the request and do the necessary authentication i.e check for the Authorization header. The lambda authorizer then allows or denies the request from passing on to the lambda method.

user_16243680
Related