API Gateway Websocket sigv4 ahthentication



I'm currently getting my head around the new Websocket feature of API Gateway and went through the following blog post to get started: https://aws.amazon.com/blogs/compute/announcing-websocket-apis-in-amazon-api-gateway/

However authentication is not used in this example and I need to see how that would work. In the post wscat is used as the websocker client and I don't believe there is a way to use that to call sigv4 APIs (unless I'm wrong ?)

Does anyone have a working code (any language would do: Python, Java, NodeJS etc.) that would connect to a Websocket that needs sigv4 auth ?

asked 5 years ago1029 views
1 Answer
Accepted Answer

It is possible, I connected to WSS endpoints using Sigv4 in two distinct ways: using headers and querystring.

Example of wscat command using headers:

wscat -H "Sec-WebSocket-Version:13" \
-H "Sec-WebSocket-Key:d6Bb3S0ZIibBDRfF460/Hw==" \
-H "Sec-WebSocket-Extensions:permessage-deflate; client_max_window_bits" \
-H "Date:20211011T205720Z" \
-H "Authorization:AWS4-HMAC-SHA256 Credential=AKIAS123456789012345/20211011/us-east-1/managedblockchain/aws4_request, SignedHeaders=date;host, Signature=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
-c wss://nd-aaaaaaaaaaaaaaaaaaaaaaaaaa.wss.ethereum.managedblockchain.us-east-1.amazonaws.com

Example of wscat command using querystring:

wscat --connect "wss://nd-aaaaaaaaaaaaaaaaaaaaaaaaaa.wss.ethereum.managedblockchain.us-east-1.amazonaws.com/?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS123456789012345%2F20211018%2Fus-east-1%2Fmanagedblockchain%2Faws4_request&X-Amz-Date=20211018T151804Z&X-Amz-Expires=30&X-Amz-SignedHeaders=host&X-Amz-Signature=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

Important: the implementation of WebSocket for web browsers do not accept headers, so you mush go with the query string version.

Code used to output a wscat command with Header auth:

Refer to these very useful examples here: https://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html

profile pictureAWS
answered 2 years ago
profile picture
reviewed 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions