Authenticating Twilio Request Signatures Using ColdFusion And HMAC-SHA1 Hashing

<!--- Param the form data. --->
<cfparam name="form.body" type="string" default="Hello!" />

<!---
	Define the Twilio Auth Key (from your Twilio dashbaord).
	This will be used to re-hash the incoming data.
--->
<cfset twilioAuthKey = "************************************" />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!---
	We have to re-hash the requested resource in order to ensure
	that the request is truly coming from Twilio. To do this, we
	have create the resource representation and compare its hash
	to the one posted in the headers.

	The resource is the requested URL concatenated with all of
	the alpha-sorted form values.
--->
<cfset resource = (
	"http://" &
	cgi.server_name &
	cgi.script_name
	) />

<!--- Check to see if we have a query string. --->
<cfif len( cgi.query_string )>

	<!--- Append the query string to the resournce. --->
	<cfset resource &= ("?" & cgi.query_string) />

</cfif>


<!---
	Now, we have to append all of the form values to the resource
	(without any delimiter). However, since ColdFusion alters the
	case of both the FORM collection keys and the Header keys. As
	such, we actually have to manually parse the HTTP request
	content in order to get the keys in their original alpha case.

	Let's break the request content in name=value pairs.
--->
<cfset formContentPairs = reMatch(
	"[^=&]+=[^&]*",
	getHttpRequestData().content
	) />

<!--- Now, let's create a collection of Twilio form keys. --->
<cfset twilioFormKeys = [] />

<!---
	Loop over the name=value pairs and extract the form key
	(in its original case) as everything before the equals.
--->
<cfloop
	index="formContentPair"
	array="#formContentPairs#">

	<!--- Append the parsed form key to the Twilio collection. --->
	<cfset arrayAppend(
		twilioFormKeys,
		listFirst( formContentPair, "=" )
		) />

</cfloop>

<!--- Now, alpha sort the form keys. --->
<cfset arraySort(
	twilioFormKeys,
	"text",
	"asc"
	) />

<!---
	Now that the keys are parsed in thier original case and sorted,
	let's add them to the resource that we are going to encode.
--->
<cfloop
	index="formKey"
	array="#twilioFormKeys#">

	<!---
		Add this Twilio form key and its associated value to the
		resource without any delimiters.
	--->
	<cfset resource &= (formKey & form[ formKey ]) />

</cfloop>


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!---
	Now that we have our resource, we need to hash it using the
	HMAC-SHA1 algorithm. To do this, we are going to dip down into
	the Java layer. Let's create our secret key representation using
	our Twilio AUTH KEY and the HMAC-SHA1 algorithm selection.
--->
<cfset secretKeySpec = createObject(
	"java",
	"javax.crypto.spec.SecretKeySpec"
	).init(
		toBinary( toBase64( twilioAuthKey ) ),
		"HmacSHA1"
		)
	/>

<!---
	Now, let's create our MAC (Message Authentication Code) generator
	to encrypt the Twilio resource we created above.
--->
<cfset mac = createObject( "java", "javax.crypto.Mac" )
	.getInstance( "HmacSHA1" )
	/>

<!--- Initialize the MAC instance using our secret key. --->
<cfset mac.init( secretKeySpec ) />

<!---
	Complete the mac encryption operation, encrypting the Twilio
	resource using the given secret key spec (that we created above).
--->
<cfset encryptedBytes = mac.doFinal(
	toBinary( toBase64( resource ) )
	) />

<!---
	At this point, we have encrypted the resource; now, we have to
	base64 encode it so that it has only printable characters.
--->

<cfset secureSignature = createObject(
	"java",
	"org.apache.commons.codec.binary.Base64"
	)
	.encodeBase64( encryptedBytes )
	/>

<!---
	The Base64 encoding returns a byte array. Let's convert the
	byte array to a normal string.
--->
<cfset secureSignature = toString( secureSignature ) />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!---
	Get the headers reference so that we can easily access the
	Twilio signature.
--->
<cfset headers = getHttpRequestData().headers />

<!---
	Now that we have re-hashed and encoded the Twilio resource,
	let's compare our version to the signature passed in the
	Headers.
--->
<cfif (
	structKeyExists( headers, "X-Twilio-Signature" ) &&
	(secureSignature eq headers[ "X-Twilio-Signature" ])
	)>

	<!--- The signatures match! This request is from Twilio. --->
	<cfset response = "Sweeet! They match!" />

<cfelse>

	<!---
		The signatures do NOT match. The request cannot be verified
		as coming from Twilio.
	--->
	<cfset response = "Nice try, tough guy!" />

</cfif>


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!--- Convert the response into Twilio XML response. --->
<cfsavecontent variable="responseXml">
	<cfoutput>

		<?xml version="1.0" encoding="UTF-8"?>
		<Response>
			<Sms>#xmlFormat( response )#</Sms>
		</Response>

	</cfoutput>
</cfsavecontent>

<!---
	Stream XML response to Twilio client. Make sure to TRIM
	the XML response such that it is valid XML.
--->
<cfcontent
	type="text/xml"
	variable="#toBinary( toBase64( trim( responseXml ) ) )#"
	/>