Are you implementing an HTTP/HTTPS endpoint for SNS? If so, you should definetly verify the incoming messages. Otherwise, anyone on the Internet can deliver messages to your HTTP/HTTPS endpoint. Which is a security risk.

How do you verify incoming messages? The SNS documentation answers this question:

You should verify the authenticity of a notification, subscription confirmation, or unsubscribe confirmation message sent by Amazon SNS.

In a nutshell, each SNS message contains a signature that we have to verify.

The npm module sns-validator does the job. Unfortunately, the module is old and lacks support for save caching and certificate download retries. Therefore, I decided to implement this on my own, which wasn’t as hard as expected. Let’s get started.

First, you need to install a few dependencies:

request and requestretry to perform HTTP(S) requests with retries

and to perform HTTP(S) requests with retries lru-cache to safely cache certificates without running out of memory

Install the modules with: