code: function validateExpressRequest(request, authToken, opts) {
    var options = opts || {};
    var webhookUrl;
  
    if (options.url) {
      // Let the user specify the full URL
      webhookUrl = options.url;
    } else {
      // Use configured host/protocol, or infer based on request
      var protocol = options.protocol || request.protocol;
      var host = options.host || request.headers.host;
  
      webhookUrl = url.format({
          protocol: protocol,
          host: host,
          pathname: request.originalUrl
      });
      if (request.originalUrl.search(/\?/) >= 0) {
        webhookUrl = webhookUrl.replace("%3F","?");
      }
  
    }
  
    if (webhookUrl.indexOf('bodySHA256') > 0) {
      return validateRequestWithBody(
        authToken,
        request.header('X-Twilio-Signature'),
        webhookUrl,
        request.body || {}
      );
    } else {
      return validateRequest(
        authToken,
        request.header('X-Twilio-Signature'),
        webhookUrl,
        request.body || {}
      );
    }
  }
docs: Utility function to validate an incoming request is indeed from Twilio (for use with express).
  adapted from https://github.com/crabasa/twiliosig
  
  @param {object} request - An expressjs request object (http://expressjs.com/api.html#req.params)
  @param {string} authToken - The auth token, as seen in the Twilio portal
  @param {object} opts - options for request validation:
  - url: The full URL (with query string) you used to configure the webhook with Twilio - overrides host/protocol options
  - host: manually specify the host name used by Twilio in a number's webhook config
  - protocol: manually specify the protocol used by Twilio in a number's webhook config