Weave Code
Aws Php Sns Message Validator Laravel Package
aws/aws-php-sns-message-validator
Standalone PHP library for validating incoming Amazon SNS HTTP(S) POST notifications. It checks the SigningCertURL, SignatureVersion, and Signature; requires PHP 8.1+ and OpenSSL, with no AWS SDK or Guzzle dependency.
Amazon SNS Message Validator for PHP lets you verify that incoming HTTP(S) POST requests are authentic Amazon SNS notifications. Using Message::fromRawPostData(), the library reads the raw php://input stream, decodes the JSON, and validates the message type and structure. Then MessageValidator confirms the SigningCertURL, SignatureVersion, and Signature are valid and consistent with the message data.
It is standalone, with no dependency on the AWS SDK for PHP or Guzzle, requiring only PHP 8.1+ and the OpenSSL extension.
- Validates SNS message signatures and certificate URLs
- Simple
isValid()andvalidate()API - Builds messages directly from raw POST data
- Zero dependencies beyond PHP and OpenSSL
- Installable via Composer
Frequently asked questions about Aws Php Sns Message Validator
- How do I validate Amazon SNS messages in a Laravel app?
- Install the package with Composer, then use Message::fromRawPostData() and MessageValidator to check incoming SNS payloads. Place validation in a dedicated middleware or at the start of your SNS webhook controller before processing the notification. Because fromRawPostData() reads php://input, run it before any middleware or code consumes the raw request body, and reject invalid messages with a 403 response.
- Does aws/aws-php-sns-message-validator require the AWS SDK for PHP or Guzzle?
- No. The library is standalone and does not depend on the AWS SDK for PHP or Guzzle. It does require PHP 8.1 or later and the OpenSSL PHP extension to verify SNS signatures and certificates.
- What PHP and Laravel versions are supported by aws/aws-php-sns-message-validator?
- The README states the package requires PHP 8.1 or later with the OpenSSL extension. It is framework-agnostic, so it can be used in any Laravel version that runs on PHP 8.1 or later. The README does not publish an explicit Laravel version test matrix, so verify compatibility in your application's CI pipeline.
- How do I install aws/aws-php-sns-message-validator with Composer?
- Run composer require aws/aws-php-sns-message-validator in your Laravel project. Composer will add the package and autoload its classes. No Laravel service provider or configuration file is required because this is a standalone PHP library.
- How should I integrate SNS message validation as Laravel middleware?
- Create a middleware class that calls Message::fromRawPostData() and then MessageValidator::validate() or isValid() on the request payload. Attach that middleware only to the route or route group that receives SNS HTTP/HTTPS posts, and return a 403 response when validation fails. For queued SNS processing, validate the payload before dispatching the job so invalid messages never enter your queue.
- Does this package verify SNS signatures and signing certificates?
- Yes. The MessageValidator checks the message's SigningCertURL, SignatureVersion, and Signature, and verifies the signature against the SNS signing certificate. This helps you securely accept notifications, subscription confirmations, and publishes from Amazon SNS.
- Does aws/aws-php-sns-message-validator cache SNS signing certificates?
- The README does not document built-in certificate caching. The validator fetches the signing certificate from the SNS SigningCertURL to verify signatures, so high-volume endpoints should be reviewed for repeated certificate fetches. Verify the behavior in your installed version or add caching/proxying if needed to avoid network bottlenecks.
- How do I handle SNS subscription confirmation messages in Laravel?
- Validate the incoming SNS request first, then inspect the message Type and handle SubscriptionConfirmation separately from Notification messages. For subscription confirmation, confirm the TopicArn is expected and visit the SubscribeURL only after successful validation. Never auto-confirm an unvalidated SNS request.
- Is aws/aws-php-sns-message-validator safe and maintained for production use?
- It is an official AWS PHP package with a focused purpose: validating inbound SNS messages. Before production use, verify the current release cadence, issue activity, and test coverage, because maintenance metadata should be checked for your installed version. Pin the Composer version, test signature validation and certificate rotation paths, and monitor for security advisories.
- What are alternatives to aws/aws-php-sns-message-validator for Laravel?
- Alternatives include implementing SNS signature verification yourself with OpenSSL and certificate fetching, or using an AWS-focused Laravel package that wraps SNS validation. Compare maintenance status, certificate caching behavior, Laravel integration, and test coverage before choosing. For most Laravel applications, the official standalone validator is the smallest direct option when you only need inbound SNS authentication.
Weaver
How can I help you explore Laravel packages today?