- How do I install ankurk91/laravel-ses-webhooks?
- Install it with Composer by running composer require ankurk91/laravel-ses-webhooks. The service provider is auto-discovered, so no manual registration is needed on supported Laravel versions. Then publish the config file with php artisan vendor:publish and set your SNS topic ARN and webhook route path.
- Which Laravel and PHP versions does this SES webhook package support?
- The declared illuminate/* and PHP constraints in composer.json determine this, and because the repository is archived they may cap below your current Laravel and PHP releases. Do a dry-run install against your target versions before committing to it. If it does not install cleanly, widening the constraints turns into an unplanned fork.
- How do I configure the webhook route and middleware?
- The package registers a route that receives SNS HTTP POST deliveries, and its config file lets you change the route path and attach middleware. Point your SNS HTTPS subscription at that URL and make sure the endpoint is publicly reachable over TLS. Middleware is the natural place to add IP allowlisting or rate limiting.
- Does this package verify the Amazon SNS signature?
- The security properties that matter are SNS signature verification against the AWS-published certificate, TopicArn pinning, Timestamp freshness checks, and MessageId deduplication. The package documentation does not settle whether all of these are implemented, so confirm line by line whether it uses aws/aws-sdk-php MessageValidator, the deprecated aws/aws-php-sns-message-validator, or hand-rolled logic. Treat the endpoint as security-sensitive regardless, since it parses untrusted input from the public internet.
- Which Laravel events are dispatched for bounce and complaint notifications?
- It re-dispatches the SNS payload as Laravel events per notification type, covering bounce, complaint, and delivery notifications. Listen for those events in your EventServiceProvider or through event discovery and react to failed, rejected, or undelivered emails. Check whether the raw payload is preserved on the event so you can keep it for audit.
- How does the package handle SNS SubscriptionConfirmation requests?
- SNS sends a SubscriptionConfirmation request that must be confirmed before notifications start flowing. Auto-confirming without validating the SubscribeURL host is an SSRF footgun, so verify that the implementation allowlists the host before fetching it. If it does not, add your own guard or confirm the subscription manually.
- Is it safe to use an archived, unmaintained package in production?
- The repository is archived with roughly 25 stars, which means there is no patch path for a signature-validation bypass, an SSRF in subscription confirmation, or a dependency CVE. Low community scrutiny also removes the backstop you get from a widely used package, and Composer abandonment adds a mild typosquat exposure if the name is ever released. If you adopt it, budget for vendoring or forking so you control fixes.
- How does this compare to SNS to SQS for SES bounce handling?
- A push webhook makes event durability depend on your app being up and reachable at delivery time. Most teams at scale converge on SNS to SQS to a queue worker, or EventBridge to SQS or Lambda, so failed deliveries are retried and buffered. This package is an accelerator for the simple path and defers, rather than avoids, that decision.
- Does it support SES v2 or EventBridge payloads?
- The package targets the legacy SNS notification shape delivered from an SES configuration set. It is not documented as understanding SES v2 or EventBridge payloads, so confirm before relying on it for a newer publishing setup. If you publish via EventBridge you will need your own ingestion layer.
- Do I need idempotent listeners for duplicate SNS messages?
- SNS delivery is at-least-once, so the same MessageId can arrive more than once and your listeners must be idempotent. Deduplicating on MessageId, either in the package or in your handler, is the usual fix. Design handlers so replaying a bounce or complaint event is harmless.