Validate Webhook requests from SendGrid

1
const { EventWebhook, EventWebhookHeader } = require('@sendgrid/eventwebhook');
2

3
// Helper method for validating SendGrid requests
4
const verifyRequest = (publicKey, payload, signature, timestamp) => {
5
  // Initialize a new SendGrid EventWebhook to expose helpful request
6
  // validation methods
7
  const eventWebhook = new EventWebhook();
8
  // Convert the public key string into an ECPublicKey
9
  const ecPublicKey = eventWebhook.convertPublicKeyToECDSA(publicKey);
10
  return eventWebhook.verifySignature(
11
    ecPublicKey,
12
    payload,
13
    signature,
14
    timestamp
15
  );
16
};
17

18
exports.handler = async (context, event, callback) => {
19
  // Access a pre-initialized Twilio client from context
20
  const twilioClient = context.getTwilioClient();
21
  // Access sensitive values such as the sendgrid key and phone numbers
22
  // from Environment Variables
23
  const publicKey = context.SENDGRID_WEBHOOK_PUBLIC_KEY;
24
  const twilioPhoneNumber = context.TWILIO_PHONE_NUMBER;
25
  const numberToNotify = context.NOTIFY_PHONE_NUMBER;
26

27
  // The SendGrid EventWebhookHeader provides methods for getting
28
  // the necessary header names.
29
  // Remember to cast these header names to lowercase to access them correctly
30
  const signatureKey = EventWebhookHeader.SIGNATURE().toLowerCase();
31
  const timestampKey = EventWebhookHeader.TIMESTAMP().toLowerCase();
32

33
  // Retrieve SendGrid's headers so they can be used to validate
34
  // the request
35
  const signature = event.request.headers[signatureKey];
36
  const timestamp = event.request.headers[timestampKey];
37

38
  // Runtime injects the request object and spreads in the SendGrid events.
39
  // Isolate the original SendGrid event contents using destructuring
40
  // and the rest operator
41
  const { request, ...sendGridEvents } = event;
42
  // Convert the SendGrid event back into an array of events, which is the
43
  // format sent by SendGrid initially
44
  const sendGridPayload = Object.values(sendGridEvents);
45

46
  // Stringify the event and add newlines/carriage returns since they're expected by validator
47
  const rawEvent =
48
    JSON.stringify(sendGridPayload).split('},{').join('},\r\n{') + '\r\n';
49

50
  // Verify the request using the public key, the body of the request,
51
  // and the SendGrid headers
52
  const valid = verifyRequest(publicKey, rawEvent, signature, timestamp);
53
  // Reject invalidated requests!
54
  if (!valid) return callback("Request didn't come from SendGrid", event);
55

56
  // Helper method to simplify repeated calls to send messages with
57
  // nicely formatted timestamps
58
  const sendSMSNotification = (recipientEmail, timestamp) => {
59
    const formattedDateTime = new Intl.DateTimeFormat('en-US', {
60
      year: 'numeric',
61
      month: 'numeric',
62
      day: 'numeric',
63
      hour: 'numeric',
64
      minute: 'numeric',
65
      second: 'numeric',
66
      hour12: true,
67
      timeZone: 'America/Los_Angeles',
68
    }).format(timestamp);
69

70
    return twilioClient.messages.create({
71
      from: twilioPhoneNumber,
72
      to: numberToNotify,
73
      body: `Email to ${recipientEmail} was opened on ${formattedDateTime}.`,
74
    });
75
  };
76

77
  // Convert the original list of events into a condensed version for SMS
78
  const normalizedEvents = sendGridPayload
79
    .map((rawEvent) => ({
80
      to: rawEvent.email,
81
      timestamp: rawEvent.timestamp * 1000,
82
      status: rawEvent.event,
83
      messageId: rawEvent.sg_message_id.split('.')[0],
84
    }))
85
    // Ensure that events are sorted by time to ensure they're sent
86
    // in the correct order
87
    .sort((a, b) => a.timestamp - b.timestamp);
88

89
  // Iterate over each event and wait for a text to be sent before
90
  // processing the next event
91
  for (const event of normalizedEvents) {
92
    // You could also await an async operation to update your db records to
93
    // reflect the status change here
94
    // await db.updateEmailStatus(event.messageId, event.status, event.timestamp);
95
    if (event.status === 'open') {
96
      await sendSMSNotification(event.to, event.timestamp);
97
    }
98
  }
99

100
  // Return a 200 OK!
101
  return callback();
102
};

1
echo "export SENDGRID_API_KEY='YOUR_API_KEY'" > sendgrid.env
2
echo "sendgrid.env" >> .gitignore
3
source ./sendgrid.env

1
// Using Twilio SendGrid's v3 Node.js Library
2
// https://github.com/sendgrid/sendgrid-nodejs
3
const sgMail = require('@sendgrid/mail');
4
sgMail.setApiKey(process.env.SENDGRID_API_KEY);
5

6
sgMail
7
  .send({
8
    from: '[email protected]', // Change to your verified sender
9
    to: '[email protected]', // Change to your recipient
10
    subject: 'Sending with Twilio SendGrid is Fun',
11
    text: 'and easy to do anywhere, even with Node.js',
12
    html: '<strong>and easy to do anywhere, even with Node.js</strong>',
13
  })
14
  .then(() => {
15
    console.log('Email sent');
16
  })
17
  .catch((error) => {
18
    console.error(error);
19
  });