When will AppSync Lambda authorization stop requiring an Authorization header?
According to this article, as of 2024-04-09 AppSync is passing request headers to Lambda authorization functions. The headers AND cookies are part of the event.requestHeaders object. This means we can now authenticate requests using cookies and headers besides Authorization.
Unfortunately, AppSync still requires the Authorization header to be set for the request to be passed to the Lambda authorizer function. From my testing, it only requires a single character, but must be present.
Are there plans to remove this requirement now that other headers and cookies can be used for authentication?
-- Frank
- 언어
- English
질문됨 2년 전787회 조회
- 최신
- 최다 투표
- 가장 많은 댓글
Hello Frank,
Thank you for posting on AWS re:Post forum. My name is Tom.
Upon further research, I see that, as of now, AppSync still requires "Authorization" header to be included when requests are passed in to the Lambda authorizer function. Further reading on the posted article, I can see that the authorization header is still necessary as it is used for caching response from Lambda function.
"When using custom authorizers, developers can continue to use the AppSync functionality that allows them to cache the response from their Lambda function based on the value of the authorization header."
To ensure AppSync caches authorization response correctly, your application may fill the Authorization Header to the same value as the application request headers, if the Lambda authorizer is making authorization decisions based only on application request headers' value.
I can see the benefits of omitting Authorization Headers under situations where Application Request Headers suffice for authorization purpose. I have informed AppSync service team for such feature request. With that said, omitting Authorization Headers through AppSync configuration requires rigorous testing and troubleshooting from AppSync service team to ensure compatibility and security, and therefore, we are not able to provide a definitive timeline on when such feature will be brought available.
I hope the above information is helpful. Thank you for posting on AWS re:Post forum and offering suggestions to make AppSync better. Have a nice day!
