Verifying the Signatures of Amazon SNS Messages

[maciejwalkowiak]

From spring-cloud-aws created by madoxas: spring-attic/spring-cloud-aws#240

I can't find where spring cloud aws verifies sns message signature (http://docs.aws.amazon.com/sns/latest/dg/SendMessageToHttp.verify.signature.html).
Is it done at all?

[maciejwalkowiak]

With the move to a new repository (https://github.com/awspring/spring-cloud-aws) I was wondering if there was any update on this issue being addressed?

I had a quick look but the code still looks to be very similar to the code in this repository (I might have missed it).

[maciejwalkowiak]

Closing this due to inactivity. Please re-open if there's more to discuss.

[maciejwalkowiak]

I know this is an old ticket, but I can't find the part of code that verifies the signature too. I think it should be in the NotificationRequestConverter.java, but I could not find it there.
According to AWS Docu the message signature should be verified on all messages. Therefore, not checking the signature could be a security leak. 🤔
And, in the Java code example from AWS it is also pointed out that the DNS name should be verified. (Don't know if this is done yet)

In the official aws-sdk-java this is automatically done in the SnsMessageManager.java, but this is not used.

Can someone either:

1. show me where the signature is verified(what I don't think is done yet),
2. or make this to a feature request.

[maciejwalkowiak]

Thanks @KarlKl for letting us know. We are taking care of it.

[WtfJoke]

I've tried to implement this feature in my fork. Not finished yet (mainly tests are missing), but verifying signature seems to work.

[WtfJoke]

Now I have opened #198