Timeout on any action while handling a webhook call

[alcazarsecdevs]

The problem

Thank you for this great project.

We are running in json-rpc mode with a RECEIVE_WEBHOOK_URL pointing to a FastAPI endpoint. When a new message arrives, we want to react to it with a thumbs up. However, the /v1/reactions/ call times out. It correctly sends the reaction to the signal servers, but the response doesn't arrive while the webhook is open. This behavior only happens when inside the webhook handler.

We have tried running 2 containers simultaneously with the same shared volume. One with json-rpc to receive real-time updates and the other with native to send reactions/messages to those updates. But this blocks even further. To the point that payloads are not even sent to signal servers. As soon as we kill the json-rpc they go through again. So we have discarded this as a solution.

What can we do to send messages or reactions from a webhook handler? Is our only solution handling the webhook through a task queue like Celery? Or can we enable some setting in signal-cli-rest-api that will solve this?

Are you using the latest released version?

• Yes

Have you read the troubleshooting page?

• Yes

What type of installation are you running?

signal-cli-rest-api Docker Container

In which mode are you using the docker container?

JSON-RPC Mode

What's the architecture of your host system?

arm64

Additional information

The behavior feels similar to #737 but it is not caused by native or normal mode.

[bbernhard]

I can't think of a reason why this shouldn't work 🤔

Does the issue only appear when you use the reactions endpoint or for any other endpoint too?

Do you have a minimal example at hand to reproduce the issue? Preferable something simple (e.g an example based on the builtin Python HTTPServer, which doesn't require complex frameworks).

[alcazarsecdevs]

I have created a minimal example with AI that uses no external libraries. I am running bbernhard/signal-cli-rest-api:0.95 with RECEIVE_WEBHOOK_URL=http://backend:8009/webhook. And the script with PHONE_NUMBER=+15551234567 python signal_webhook_minimal.py (Python 3.11.14).

#!/usr/bin/env python3
"""
Minimal Signal webhook handler using only Python stdlib.

- Exposes POST /webhook
- Expects "receive" payloads from signal-cli-rest-api
- Reacts to the incoming message (👀 / 👍 / 👎) and sends a reply

Env:
  - PHONE_NUMBER (required): Signal number registered in signal-cli-rest-api (e.g. +15551234567)
  - SIGNAL_REST_API_URL (optional): default http://signal-cli-rest-api:8080
  - PORT (optional): default 8009
"""

import json
import os
import sys
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen

PHONE_NUMBER = os.environ.get("PHONE_NUMBER")
SIGNAL_REST_API_URL = os.environ.get("SIGNAL_REST_API_URL", "http://signal-cli-rest-api:8080")
PORT = int(os.environ.get("PORT", "8009"))
TIMEOUT = 5.0


def _log(msg: str) -> None:
    print(msg, file=sys.stdout, flush=True)


def _post_json(url: str, payload: dict, timeout: float = 5.0) -> tuple[int, str]:
    data = json.dumps(payload).encode("utf-8")
    req = Request(url, data=data, headers={"Content-Type": "application/json"}, method="POST")
    try:
        with urlopen(req, timeout=timeout) as resp:
            return resp.getcode(), resp.read().decode("utf-8")
    except HTTPError as e:
        return e.code, e.read().decode("utf-8", errors="replace")
    except URLError as e:
        return 0, str(e)


def react_to_message(*, phone_number: str, recipient: str, timestamp: int, reaction: str, timeout: float = 5.0) -> None:
    url = f"{SIGNAL_REST_API_URL}/v1/reactions/{phone_number}"
    payload = {"reaction": reaction, "recipient": recipient, "target_author": recipient, "timestamp": timestamp}
    code, body = _post_json(url, payload, timeout=timeout)
    if code and 200 <= code < 300:
        _log(f"[react] OK {code}")
    else:
        _log(f"[react] ERROR {code} {body}")


def send_message(*, phone_number: str, recipient: str, message: str, timeout: float = 5.0) -> None:
    url = f"{SIGNAL_REST_API_URL}/v2/send"
    payload = {"number": phone_number, "recipients": [recipient.lstrip("@")], "message": message}
    code, body = _post_json(url, payload, timeout=timeout)
    if code and 200 <= code < 300:
        _log(f"[send] OK {code}")
    else:
        _log(f"[send] ERROR {code} {body}")


class Handler(BaseHTTPRequestHandler):
    def _write_json(self, obj: dict, status: int = 200) -> None:
        data = json.dumps(obj).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)

    def do_POST(self) -> None:
        if self.path != "/webhook":
            _log(f"[webhook] path not found: {self.path}")
            self._write_json({"ok": False, "error": "not found"}, status=404)
            return

        if not PHONE_NUMBER:
            _log("[webhook] PHONE_NUMBER not set")
            self._write_json({"ok": False, "error": "PHONE_NUMBER not set"}, status=500)
            return

        try:
            length = int(self.headers.get("Content-Length", "0"))
            raw = self.rfile.read(length) if length > 0 else b"{}"
            payload = json.loads(raw.decode("utf-8") or "{}")
        except Exception as e:
            _log(f"[webhook] Failed to parse JSON: {e}")
            self._write_json({"ok": False, "error": "invalid json"}, status=400)
            return

        # Respond to the webhook quickly; do work inline but never block response
        self._write_json({"ok": True})

        # Extract expected fields
        method = payload.get("method")
        params = payload.get("params") or {}
        envelope = params.get("envelope") or {}
        data_message = envelope.get("dataMessage") or {}
        message = (data_message.get("message") or "").strip()
        chat_id = envelope.get("sourceUuid") or envelope.get("source") or ""
        message_id = data_message.get("timestamp") or envelope.get("timestamp") or 0
        username = envelope.get("sourceName") or ""

        _log(f"[webhook] method={method} chat_id={chat_id} message_id={message_id} user={username!r} msg={message!r}")

        if method != "receive":
            _log("[webhook] Ignoring non-receive payload")
            return
        if not chat_id or not message_id or not message:
            _log("[webhook] Missing chat_id/message_id/message; ignoring")
            return

        # Neutral reaction to acknowledge receipt
        try:
            react_to_message(
                phone_number=PHONE_NUMBER, recipient=chat_id, timestamp=int(message_id), reaction="👀", timeout=TIMEOUT
            )
        except Exception as e:
            _log(f"[react] exception: {e}")

        # Very simple command handling
        try:
            if message.startswith("/help"):
                send_message(
                    phone_number=PHONE_NUMBER,
                    recipient=chat_id,
                    message="✅ You can ask for /help anytime.",
                    timeout=TIMEOUT,
                )
                # Positive reaction for success
                react_to_message(
                    phone_number=PHONE_NUMBER,
                    recipient=chat_id,
                    timestamp=int(message_id),
                    reaction="👍",
                    timeout=TIMEOUT,
                )
            else:
                send_message(
                    phone_number=PHONE_NUMBER,
                    recipient=chat_id,
                    message="Hi! Send /help to get started.",
                    timeout=TIMEOUT,
                )
        except Exception as e:
            _log(f"[send] exception: {e}")
            try:
                react_to_message(
                    phone_number=PHONE_NUMBER,
                    recipient=chat_id,
                    timestamp=int(message_id),
                    reaction="👎",
                    timeout=TIMEOUT,
                )
            except Exception as e2:
                _log(f"[react on error] exception: {e2}")

    def log_message(self, format: str, *args) -> None:
        # Silence default HTTPServer logging (we already log)
        return


def main() -> None:
    server = HTTPServer(("0.0.0.0", PORT), Handler)
    _log(f"Signal webhook server listening on 0.0.0.0:{PORT}")
    _log(f"SIGNAL_REST_API_URL={SIGNAL_REST_API_URL} PHONE_NUMBER={PHONE_NUMBER}")
    try:
        server.serve_forever()
    except KeyboardInterrupt:
        _log("Shutting down...")
        server.server_close()


if __name__ == "__main__":
    main()

[bbernhard]

Works for me 🤔

(I am not running Version 0.95 though, but an unreleased dev version, which is based on the latest signal-cli Version. If you want to give that one a try, use this docker docker tag: bbernhard/signal-cli-rest-api:1762124556-ci)

[alcazarsecdevs]

Unfortunately I see the same behavior with bbernhard/signal-cli-rest-api:1762124556-ci. Tested on Ubuntu server (aarch64).

[react] exception: timed out
[send] exception: timed out
[react on error] exception: timed out

From the Signal user perspective, it takes 15s (3 timeouts) for the bot to finish replying to each message. So if you send it 4 messages in a row it will spend 1 minute to handle those.

I can mitigate this by setting a very short timeout (e.g. 0.25s) but then I must assume that every call to signal-cli during the webhook handling is successful. Since I am always getting a timeout exception instead of the real response.

[bbernhard]

Is that load specific? Or in other words: Does that also happen if you react to one message? Or only if you react to multiple messages in a row?

[alcazarsecdevs]

It isn't. It also happens with a single message.

It is just more noticeable when messages accumulate. But it also times out with a single one and even if you only react once. But in that case, from the signal user perspective, it looks like everything is fine. Because the first reaction happens as soon as it's requested. The issue is that the request doesn't complete. So the bot can not proceed with the rest of the code (unless it ignores responses). And only after 5s (the timeout time in the example) can the code move on with the next action - such as sending a message after reacting.