Verifying SendGrid's Signed Event Webhook in Django-CodePudding

I am trying to get signed from sengrid Webhook:

https://docs.sendgrid.com/for-developers/tracking-events/getting-started-event-webhook-security-features

from sendgrid.helpers.eventwebhook import EventWebhook, EventWebhookHeader

def is_valid_signature(request):

#event_webhook_signature=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_SIGNATURE']
#event_webhook_timestamp=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_TIMESTAMP']

   event_webhook = EventWebhook()
   key=settings.SENDGRID_HEADER


    ec_public_key = event_webhook.convert_public_key_to_ecdsa(key)

   text=json.dumps(str(request.body))

   return event_webhook.verify_signature(
      text,
      request.headers[EventWebhookHeader.SIGNATURE],
      request.headers[EventWebhookHeader.TIMESTAMP],
      ec_public_key
  )

When I send test example from sengrid, always return False. I compared keys and all is correct, so, I think that the problem is the sintax of the payload:

 "b[{\"email\":\"[email protected]\",\"timestamp\":1648560198,\"smtp-id\":\"\\\\u003c14c5d75ce93.dfd.64b469@ismtpd-555\\\\u003e\",\"event\":\"processed\",\"category\":[\"cat facts\"],\"sg_event_id\":\"G6NRn4zC5sGxoV2Hoz7gpw==\",\"sg_message_id\":\"14c5d75ce93.dfd.64b469.filter0001.16648.5515E0B88.0\"},{other tests},\\r\\n]\\r\\n"

CodePudding user response：

I think the issue is that you are calling:

text = json.dumps(str(request.body))

json.dumps serializes an object to a JSON formatted string, but str(request.body) is already a string.

Try just

text = str(request.body)

CodePudding user response：

I found the solution, my function is now like this:

def is_valid_signature(request):

#event_webhook_signature=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_SIGNATURE']
#event_webhook_timestamp=request.META['HTTP_X_TWILIO_EMAIL_EVENT_WEBHOOK_TIMESTAMP']

event_webhook = EventWebhook()
key=settings.SENDGRID_HEADER


ec_public_key = event_webhook.convert_public_key_to_ecdsa(key)
    

return event_webhook.verify_signature(
    request.body.decode('latin-1'),
    request.headers[EventWebhookHeader.SIGNATURE],
    request.headers[EventWebhookHeader.TIMESTAMP],
    ec_public_key
)

I had to decode in Latin-1, because we have my codification in UTF-8.

Thanks