验证 SendGrid 的签名事件 Webhook？

Question

>我正在尝试从此链接实现验证。

https://sendgrid.com/docs/for-developers/tracking-events/getting-started-event-webhook-security-features/#the-signed-event-webhook

我不想要其中的OAuth部分，而是使用公钥和标头来验证数据。我看过很多与SendGrid的事件Webhook相关的帖子，但没有任何东西可以验证它。

这就是我尝试过的，但显然有些地方是错误的。我真的不确定如何将代码从文档转换为 C#。我不确定请求中的每条数据应该去哪里。有人对此有任何见解吗？

public async Task<IHttpActionResult> EventsHook()
{
IEnumerable<string> signatureFromHeader = Request.Headers.GetValues("X-Twilio-Email-Event-Webhook-Signature");
byte[] timeStampBytes = Encoding.ASCII.GetBytes(Request.Headers.GetValues("X-Twilio-Email-Event-Webhook-Timestamp").First());
byte[] body = await Request.Content.ReadAsByteArrayAsync();
byte[] payloadHash = timeStampBytes.Concat(body).ToArray();
byte[] signatureByteArray = Convert.FromBase64String(signatureFromHeader.First());
var publicKey = "{myPublicKey}";
byte[] publicKeyBytes = Convert.FromBase64String(publicKey);
var ecdsaParams = new ECParameters
{
D = publicKeyBytes
};
using (var ecdsa = ECDsa.Create(ecdsaParams))
{
if (ecdsa.VerifyData(payloadHash, signatureByteArray, HashAlgorithmName.SHA256))
{
return Ok();
}
return StatusCode(System.Net.HttpStatusCode.Forbidden);
}
}

Answer 1

我刚刚实现了这个，我可以帮你：

1-我使用库starkbank-ecdsa来验证签名。 2-我声明了此接口

public interface IEmailWebHookRequestValidator
{
bool IsValidRequest(HttpRequest request);
}

3-此接口的实现是这样的：

public class SendGridWebHookRequestValidator : IEmailWebHookRequestValidator
{
private const string SIGNATURE_HEADER = "X-Twilio-Email-Event-Webhook-Signature";
private const string TIMESTAMP_HEADER = "X-Twilio-Email-Event-Webhook-Timestamp";

private readonly string _sendGridWebHookPublicKey;

public SendGridWebHookRequestValidator(ISettingsProvider settingsProvider)
{
_sendGridWebHookPublicKey = settingsProvider.SendGridWebHookPublicKey //"public key that you can get from SendGrid website when you enable Event Webhook's signature";
}

public bool IsValidRequest(HttpRequest request)
{
request.Headers.TryGetValue(SIGNATURE_HEADER, out var signatureHeaderValues);
request.Headers.TryGetValue(TIMESTAMP_HEADER, out var timestampHeaderValues);

var signature = signatureHeaderValues.FirstOrDefault();
var timestamp = timestampHeaderValues.FirstOrDefault();

if (string.IsNullOrWhiteSpace(signature) || string.IsNullOrWhiteSpace(timestamp))
{
return false;
}

var body = ReadStream(request.Body);

return VerifySignature(_sendGridWebHookPublicKey, body, signature, timestamp);
}

public bool VerifySignature(string verificationKey, string payload, string signature, string timestamp)
{
var publicKey = PublicKey.fromPem(verificationKey);

var timestampedPayload = timestamp + payload;
var decodedSignature = Signature.fromBase64(signature);

return Ecdsa.verify(timestampedPayload, decodedSignature, publicKey);
}

public static string ReadStream(Stream stream)
{
using var ms = new MemoryStream();

stream.CopyTo(ms);
return Encoding.UTF8.GetString(ms.GetBuffer(), 0, (int)ms.Length);
}
}

4. ISettingsProvider 只是一个接口，可帮助您从设置中检索公钥。

5. 当您的 webhook 收到 httprequest 时，只需将其传递给 IsValidRequest 方法，即可轻松使用上面的代码。

Answer 2

使用从 Webhook.site 复制到 Postman 的有效负载进行测试时，我遇到了这个问题。

我没有做的一件事是邮递员有效载荷上的 ENTER(新行(。这正在更改签名的预期有效负载。