Phase 2: Validate AWS SNS message signatures on the webhook

[dkwiebe]

Summary

The webhook endpoint at POST /webhook/{token} authenticates callers only by the project token in the URL. It does not verify that the request was actually signed by AWS SNS. Anyone who discovers a project's token can inject arbitrary fake events.

Implementation

Create app/Http/Middleware/ValidateSnsSignature.php:

1. Read x-amz-sns-message-type and x-amz-sns-message-signature + x-amz-sns-signing-cert-url headers
2. Validate the SigningCertURL is from an amazonaws.com domain (prevents certificate substitution attacks)
3. Fetch the certificate (cache it — AWS rotates certs rarely)
4. Build the string-to-sign per AWS SNS signature spec
5. Verify with openssl_verify
6. Return 403 on failure

Apply the middleware only to the webhook route in routes/web.php.

Note: SubscriptionConfirmation messages must also be verified — the signed fields differ slightly from Notification messages. Refer to AWS docs for both message type specifications.

Acceptance Criteria

• Requests without a valid SNS signature are rejected with 403
• Legitimate SNS notifications continue to be processed correctly
• Signing certificate is cached to avoid fetching on every request
• Direct SES format (non-SNS) path still works if needed (consider a bypass flag per project)