Add native support for verifying webhook events with dynamic signatures
Answered
Which Cloud Service Provider (CSP)?: Fivetran-managed cloud service
Which connector or destination is being used? (Specific product version / type): Webhooks event connector receiving Twilio SendGrid Event Webhook events
Additional details: Please add native support for verifying Twilio SendGrid Signed Event Webhooks. SendGrid dynamically signs each request using ECDSA and sends the signature and timestamp in the X-Twilio-Email-Event-Webhook-Signature and X-Twilio-Email-Event-Webhook-Timestamp headers. Verification requires SendGrid’s public key and the unmodified raw request-body bytes combined with the timestamp. Fivetran currently supports shared-secret HMAC, static token authentication, or no authentication; its HMAC option is incompatible with SendGrid’s ECDSA signatures. As a result, SendGrid events can only be ingested by selecting None, leaving the endpoint without sender verification. Please support configurable ECDSA signature verification for webhook connectors, including public-key configuration, signature and timestamp header names, raw-body verification, and timestamp/replay validation.
https://www.twilio.com/docs/sendgrid/for-developers/tracking-events/getting-started-event-webhook-security-features#verify-the-signature
-
Official comment
Hi Shida, thank you for raising this request. I believe you were able to sync this data using our Sendgrid connector?
Fivetran’s token-based authentication can be used with SendGrid OAuth2 as a workaround. SendGrid caches the access token, so this will work while that token remains valid. If the token expires/changes, you will need to obtain the new token and update the secret in Fivetran manually because the Webhooks connector does not manage the OAuth token lifecycle automatically. While ECDSA is currently not on our roadmap, we will keep tracking demand for it.
Thank you,
Parmeet
Please sign in to leave a comment.
Comments
1 comment