SendGrid事件Webhook签名验证失败问题求助

Let's work through why your verifySignature() call keeps returning false and fix it up:

The Core Issue: Incorrect Payload Handling #

The biggest problem here is how you're generating the payload for verification. SendGrid creates the signature using the full raw request body (which is a JSON array when multiple events are sent), but you're extracting just the first event, re-encoding it as JSON, and adding a newline. This modifies the exact data SendGrid used to compute the signature—so verification will never pass.

Fixed Code Implementation #

Instead of altering the request data, use the original raw request body directly. Here's the corrected code (I'm assuming you're using Laravel based on your $request syntax):

$eventWebhook = new EventWebhook();
$ecPublicKey = $eventWebhook->convertPublicKeyToECDSA($publicKey);
// Grab the raw, unmodified request body exactly as SendGrid sent it
$payload = $request->getContent();
$signature = $request->header('X-Twilio-Email-Event-Webhook-Signature');
$timestamp = $request->header('X-Twilio-Email-Event-Webhook-Timestamp');

$valid = $eventWebhook->verifySignature($ecPublicKey, $payload, $signature, $timestamp);

Extra Checks to Guarantee Success #

• Validate your public key: Double-check you copied it correctly from your SendGrid dashboard. The convertPublicKeyToECDSA() method handles formatting, but make sure you didn't add extra characters or miss any parts of the key.
• Leave the request body untouched: Don't parse, re-encode, or reformat the JSON in any way before passing it to verifySignature(). Even tiny changes like extra whitespace will break the signature match.
• Confirm header spellings: Make sure you're fetching the exact header names—typos in X-Twilio-Email-Event-Webhook-Signature or X-Twilio-Email-Event-Webhook-Timestamp will lead to invalid verification attempts.

内容的提问来源于stack exchange，提问作者Mick