All requests made by Plivo to your server URLs consist of a X-Plivo-Signature-V2, X-Plivo-Signature-Ma-V2, and X-Plivo-Signature-V2-Nonce HTTP headers. To validate the request and to verify that the request to your server has originated from Plivo, you must generate the signature at your end and compare it with X-Plivo-Signature-V2 or X-Plivo-Signature-Ma-V2 parameter in the HTTP header and check whether they are identical.
Note:
You can either use X-Plivo-Signature-V2 or X-Plivo-Signature-Ma-V2to validate the signature
X-Plivo-Signature-V2 is generated using the Auth Token of the associated Main Account or Sub-Account. To validate using X-Plivo-Signature-V2 request header, you must generate the signature at your end using the same Main Account or Sub-Account.
X-Plivo-Signature-Ma-V2 is always generated using the Auth Token of the Main Account. To validate using X-Plivo-Signature-Ma-V2 request header, you must generate the signature using the Main account.
Generating and Validating the Signature
You can generate the signature by calculating the Keyed-Hash Message Authentication Code (HMAC) with the following parameters:
Key - Your Plivo Auth Token
Message - Base URI appended with X-Plivo-Signature-V2-Nonce.
Hashing Function - SHA256
For example, if the base URI is “http://foo.com/answer/” and X-Plivo-Signature-V2-Nonce is “05429567804466091622”, the message will be “http://foo.com/answer/05429567804466091622”
Validating signatures using the latest server SDKs
To validate and verify that the request to your server has originated from Plivo, you must compare the generated signature with X-Plivo-Signature-V2 parameter in the HTTP header and check whether they are identical. You also require your auth_token, X-Plivo-Signature-V2-Nonce, and the original URL of your server to which callback has been sent.
fromflaskimportFlask,request,make_response,url_forimportplivoapp=Flask(__name__)@app.route('/receive_sms/',methods=['GET','POST'])defsignature():signature=request.headers.get('X-Plivo-Signature-V2')nonce=request.headers.get('X-Plivo-Signature-V2-Nonce')uri=url_for('signature',_external=True)auth_token="Your_Auth_Token"output=plivo.utils.validate_signature(uri,nonce,signature,auth_token)print(output)from_number=request.values.get('From')# Sender's phone numer
to_number=request.values.get('To')# Receiver's phone number - Plivo number
text=request.values.get('Text')# The text which was received
print('Message received - From: %s, To: %s, Text: %s'%(from_number,to_number,text))return"Text received"if__name__=="__main__":app.run(host='0.0.0.0',debug=True)
require'sinatra'require'rubygems'require'plivo'includePlivorequire'uri'get'/receive_sms/'doauth_token="Your_Auth_Token"signature=request.env["HTTP_X_PLIVO_SIGNATURE_V2"]nonce=request.env["HTTP_X_PLIVO_SIGNATURE_V2_NONCE"]url=request.urluri=(url.split("?"))[0]output=Plivo::Utils.valid_signature?(uri,nonce,signature,auth_token)putsoutputfrom_number=params[:From]# The phone number of the person who sent the SMSto_number=params[:To]# Your Plivo number that will receive the SMStext=params[:Text]# The text which was received on your Plivo numberputs"Message received from #{from_number} : #{text}"end
varplivo=require('plivo');varexpress=require('express');varapp=express();app.set('port',(process.env.PORT||5000));app.use(express.static(__dirname+'/public'));app.use(express.urlencoded({extended:true}))app.all('/receive_sms/',function(req,res){varauth_token=('Your_AUTH_TOKEN');varsignature=req.get('X-Plivo-Signature-V2');varnonce=req.get('X-Plivo-Signature-V2-Nonce');varfullUrl=req.protocol+'://'+req.get('host')+req.originalUrl;varfrom_number=req.body.From;// Sender's phone numbervarto_number=req.body.To;// Receiver's phone number - Plivo numbervartext=req.body.Text;// The text which was receivedvaroutput=plivo.validateSignature(fullUrl,nonce,signature,auth_token)console.log(output);console.log('From : '+from_number+' To : '+to_number+' Text : '+text);});app.listen(app.get('port'),function(){console.log('Node app is running on port',app.get('port'));});
<?phprequire'vendor/autoload.php';usePlivo\Util\signatureValidation;$auth_token="Your_Auth_Token";$signature=$_SERVER["HTTP_X_PLIVO_SIGNATURE_V2"];$nonce=$_SERVER["HTTP_X_PLIVO_SIGNATURE_V2_NONCE"];$url='http'.(isset($_SERVER['HTTPS'])?'s':'').'://'."{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";$uri=explode('?',$url);$uri1=$uri[0];$SVUtil=newsignatureValidation();$output=$SVUtil->validateSignature($uri1,$nonce,$signature,$auth_token);var_export($output);$from_number=$_REQUEST["From"];// Sender's phone numer$to_number=$_REQUEST["To"];// Receiver's phone number - Plivo number$text=$_REQUEST["Text"];// The SMS text message which was receivedecho("Message received from $from_number : $text");?>