fix: verify SNS message signatures for SES event webhooks

VE
1mo ago
+441-10

Fixes #440
Delivery, bounce, and complaint events were silently dropped due to invalid signature verification

Problem

Self-hosted useSend deployments silently drop SES delivery, bounce, and complaint events because SNS message signature verification was failing.

Root Cause

The canonical string to sign was missing the final newline terminator on each field value, causing signature verification to always fail. AWS SNS expects: field1\nvalue1\nfield2\nvalue2\n...\n (with trailing newline).

Solution

  • Created sns-message-validator.ts, sns-message-validator.unit.test.ts with correct AWS canonical string formatting
  • Verify SNS signatures before processing delivery/bounce/complaint events
  • Integrated signature verification into /api/ses_callback endpoint
  • Added 4 unit tests with independently verified string literals
image image

Verification

✅ All 130 unit tests passing
✅ 4 new SNS validator tests passing
✅ No pre-existing test failures

Related

Addresses: #439

Summary by cubic

Fixes #440. Self-hosted useSend deployments were silently dropping SES delivery, bounce, and complaint events because SNS signature verification always failed — the canonical string to sign was missing the trailing newline on each field. The new validator builds the string in AWS's expected format and verifies signatures before /api/ses_callback processes any message.

Bug Fixes

  • Added sns-message-validator.ts with canonical string building, certificate fetch, and RSA-SHA1/RSA-SHA256 verification selected by SignatureVersion.
  • Certificates are fetched only from https://sns.<region>.amazonaws.com hosts derived from the message's TopicArn to prevent SSRF and support all AWS regions.
  • Rejects and logs invalid signatures on Notification and SubscriptionConfirmation messages, including the latter's different field order.
  • Added unit tests covering canonical field formatting, optional field omission, trailing newline, subscription confirmation ordering, and certificate URL validation.

Summary by CodeRabbit

  • Security

    • SNS callback notifications are verified before processing.
    • Invalid or unverifiable signatures are rejected and logged.
    • Certificate retrieval is restricted to the notification’s valid AWS SNS region.

  • Bug Fixes

    • Strengthened protection against forged callback messages.
    • Improved handling of SNS subscription confirmations and supported AWS regions.

  • Tests

    • Added coverage for message formatting, signature validation, certificate handling, regional endpoint validation, and optional subscription fields.