validateTwilioSignature (webhook-security.ts)

Validates Twilio webhook signatures using HMAC-SHA1 with replay attack prevention through time-windowed request caching.

// Source: https://github.com/TristanBrotherton/openclaw-voice-call-realtime | License: MIT | Copyright 2026 OpenClaw Foundation (original voice-call plugin)
// Provided via justclaw.it.com; keep this notice with the code.
import crypto from "node:crypto";
import { getHeader } from "./http-headers.js";
import type { WebhookContext } from "./types.js";

const REPLAY_WINDOW_MS = 10 * 60 * 1000;
const REPLAY_CACHE_MAX_ENTRIES = 10_000;
const REPLAY_CACHE_PRUNE_INTERVAL = 64;

type ReplayCache = {
  seenUntil: Map<string, number>;
  calls: number;
};

const twilioReplayCache: ReplayCache = {
  seenUntil: new Map<string, number>(),
  calls: 0,
};

const plivoReplayCache: ReplayCache = {
  seenUntil: new Map<string, number>(),
  calls: 0,
};

const telnyxReplayCache: ReplayCache = {
  seenUntil:

... (truncated -- full source via MCP)