无法验证来自 Sendgrid 事件 webhook 的签名

Question

我正在努力让已签名的事件 webhook 正常工作：

https://docs.sendgrid.com/for-developers/tracking-events/getting-started-event-webhook-security-features

我已启用它们并且可以看到标头，但 verifySignature() 总是返回 false。

这就是我所拥有的：

$eventWebhook = new EventWebhook();
$ecPublicKey = $eventWebhook->convertPublicKeyToECDSA($publicKey));
$payload = json_encode( $request->all()[0] ) . "\r\n";

$valid = $eventWebhook->verifySignature(
            $ecPublicKey,
            $payload,
            $request->header('X-Twilio-Email-Event-Webhook-Signature'),
            $request->header('X-Twilio-Email-Event-Webhook-Timestamp')
        );

我收到多个事件，所以添加了 [0]

Answer 1

让它像这样工作：

$eventWebhook = new EventWebhook();
$ecPublicKey = $eventWebhook->convertPublicKeyToECDSA(Cache::get('sendgrid-key'));
$payload =  $request->getContent();
return $eventWebhook->verifySignature(
            $ecPublicKey,
            $payload,
            $request->header('X-Twilio-Email-Event-Webhook-Signature'),
            $request->header('X-Twilio-Email-Event-Webhook-Timestamp')
        );