Improve webhooks authorization #196
Conversation
I have a bug on my application with Lift: I want to secure a webhook call using with a different header than Authorization (I do not have a hand on the header). The HTTP request does not contain an Authorization header and thus receives a 401. The documentation: https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html All headers are available in the event anyway, and Lift doesn't implement authorizer caching by default, so we can juste empty the `identitySource` property.
src/constructs/aws/Webhook.ts
Outdated
| @@ -124,7 +124,7 @@ export class Webhook extends AwsConstruct { | |||
| authorizerPayloadFormatVersion: "2.0", | |||
| authorizerType: "REQUEST", | |||
| name: `${id}-authorizer`, | |||
| identitySource: ["$request.header.Authorization"], | |||
| identitySource: [], | |||
There was a problem hiding this comment.
identitySource is optional altogether when aurthorizerType is set to REQUEST.
The identity source for which authorization is requested.
For a
REQUESTauthorizer, this is optional. The value is a set of one or more mapping expressions of the specified request parameters. The identity source can be headers, query string parameters, stage variables, and context parameters. For example, if an Auth header and a Name query string parameter are defined as identity sources, this value is route.request.header.Auth, route.request.querystring.Name for WebSocket APIs. For HTTP APIs, use selection expressions prefixed with$, for example,$request.header.Auth,$request.querystring.Name. These parameters are used to perform runtime validation for Lambda-based authorizers by verifying all of the identity-related request parameters are present in the request, not null, and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function. Otherwise, it returns a 401 Unauthorized response without calling the Lambda function. For HTTP APIs, identity sources are also used as the cache key when caching is enabled. To learn more, see Working with AWS Lambda authorizers for HTTP APIs.For
JWT, a single entry that specifies where to extract the JSON Web Token (JWT) from inbound requests. Currently only header-based and query parameter-based selections are supported, for example$request.header.Authorization.@link http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-identitysource
This argument is optional when using REQUEST type authorizer
I have a bug on my application with Lift: I want to secure a webhook call using with a different header than Authorization (I do not have control on the header).
The HTTP request does not contain an Authorization header and thus receives a 401 error. The documentation: https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html
All headers are available in the event anyway, and Lift doesn't implement authorizer caching by default, so we can juste empty the
identitySourceproperty.