fix(voice-call): retry Twilio signature verification without port in URL#25140
Merged
steipete merged 2 commits intoopenclaw:mainfrom Mar 3, 2026
Merged
fix(voice-call): retry Twilio signature verification without port in URL#25140steipete merged 2 commits intoopenclaw:mainfrom
steipete merged 2 commits intoopenclaw:mainfrom
Conversation
Comment on lines
+490
to
+491
| const urlWithoutPort = "https://example.com:8443/voice/webhook"; | ||
| const urlWithPort = "https://example.com:8443/voice/webhook"; |
Contributor
There was a problem hiding this comment.
Variable names swapped - urlWithoutPort actually contains a port (:8443) and vice versa.
Suggested change
| const urlWithoutPort = "https://example.com:8443/voice/webhook"; | |
| const urlWithPort = "https://example.com:8443/voice/webhook"; | |
| // Twilio signs using URL without port | |
| const urlWithPort = "https://example.com:8443/voice/webhook"; | |
| const urlWithoutPort = "https://example.com:8443/voice/webhook"; |
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/voice-call/src/webhook-security.test.ts
Line: 490-491
Comment:
Variable names swapped - `urlWithoutPort` actually contains a port (`:8443`) and vice versa.
```suggestion
// Twilio signs using URL without port
const urlWithPort = "https://example.com:8443/voice/webhook";
const urlWithoutPort = "https://example.com:8443/voice/webhook";
```
How can I resolve this? If you propose a fix, please make it concise.
Comment on lines
+490
to
+491
| const urlWithoutPort = "https://example.com:8443/voice/webhook"; | ||
| const urlWithPort = "https://example.com:8443/voice/webhook"; |
Contributor
There was a problem hiding this comment.
Both variables have identical values - one should be without the port.
Suggested change
| const urlWithoutPort = "https://example.com:8443/voice/webhook"; | |
| const urlWithPort = "https://example.com:8443/voice/webhook"; | |
| const urlWithPort = "https://example.com:8443/voice/webhook"; | |
| const urlWithoutPort = "https://example.com/voice/webhook"; |
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/voice-call/src/webhook-security.test.ts
Line: 490-491
Comment:
Both variables have identical values - one should be without the port.
```suggestion
const urlWithPort = "https://example.com:8443/voice/webhook";
const urlWithoutPort = "https://example.com/voice/webhook";
```
How can I resolve this? If you propose a fix, please make it concise.061d311 to
1a11529
Compare
c0231fd to
dd900b3
Compare
3 tasks
Twilio signs webhook requests using the URL without the port component, even when the publicUrl config includes a non-standard port. Add a fallback that strips the port from the verification URL when initial validation fails, matching the behavior of Twilio's official helper library. Closes openclaw#6334
4b3c957 to
03e6142
Compare
Contributor
dawi369
pushed a commit
to dawi369/davis
that referenced
this pull request
Mar 3, 2026
OWALabuy
pushed a commit
to kcinzgg/openclaw
that referenced
this pull request
Mar 4, 2026
zooqueen
pushed a commit
to hanzoai/bot
that referenced
this pull request
Mar 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds stripPortFromUrl helper and retry path in �xtensions/voice-call/src/webhook-security.ts.
Also cherry-picks a pre-existing Windows CI test fix from PR #26049 ( est(bash-tools): fix Windows CI path prepend assertion). That fix is a prerequisite for the Windows test job to pass on any PR running the full Node test suite; it is unrelated to this feature change and was submitted as a standalone PR.
Change Type
Scope
Linked Issue
N/A
User-visible Changes
See summary above.
Security Impact (required)
Tightens security: prevents false-negative signature verification rejections when a reverse proxy strips the port number from the URL. No new attack surface introduced.
Repro + Verification
Evidence
Existing test suite passes on Linux and macOS.
Human Verification (required)
Compatibility
No breaking changes.
Failure Recovery
N/A
Risks
Low. Targeted single-file fix with existing test coverage.