Skip to content

Api Gateway is not sending Cognito data to Lambda

0

Hello,

I've created a common Cognito + Api Gateway (REST) + Lambda API, and the API works, it authenticates with Cognito and works well, but the problem is that even if I use the templated "Mapping template" for de Integration Request or even if configuring as "Lambda Proxy", the lambda doesn't receive the Cognito data. The event I receive is as follows:

{"context": "LambdaContext([aws_request_id=<examplerequestmasked>,log_group_name=/aws/lambda/lambdaname_for_example,log_stream_name=2024/06/03/[$LATEST]exampletime,function_name=examplefunctionname,memory_limit_in_mb=128,function_version=$LATEST,invoked_function_arn=arn:aws:lambda:eu-west-1:0123456789:function:examplefunctionname,client_context=None,identity=CognitoIdentity([cognito_identity_id=None,cognito_identity_pool_id=None])])", "event": { "resource": "/check", "path": "/check", "httpMethod": "POST", "headers": { "accept": "*/*", "Authorization": "Bearer <the token I provided in the request, obtained from Cognito>", "Host": "examplehost.execute-api.eu-west-1.amazonaws.com", "User-Agent": "curl/7.81.0", "X-Amzn-Trace-Id": "Root=1-example-4fc9b0d401e9afsdfsdgghr "X-Forwarded-Port": "443", "X-Forwarded-Proto": "https" }, "multiValueHeaders": { "accept": [ "*/*" ], "Authorization": [ "Bearer <the token I provided in the request, obtained from Cognito>" ], "Host": [ "examplehost.execute-api.eu-west-1.amazonaws.com" ], "User-Agent": [ "curl/7.81.0" ], "X-Amzn-Trace-Id": [ "Root=1-example-4fc9b0d401e9afsdfsdgghr" ], "X-Forwarded-For": [ "240.20.10.120" (this is not real) ], "X-Forwarded-Port": [ "443" ], "X-Forwarded-Proto": [ "https" ] }, "queryStringParameters": { "kkk": "4333" }, "multiValueQueryStringParameters": { "kkk": [ "4333" ] }, "pathParameters": "None", "stageVariables": "None", "requestContext": { "resourceId": "example", "resourcePath": "/check", "httpMethod": "POST", "extendedRequestId": "example_request_id=", "requestTime": "03/Jun/2024:08:03:47 +0000", "path": "/v1/check", "accountId": "0123456789", "protocol": "HTTP/1.1", "stage": "v1", "domainPrefix": "exampleDomainPrefix", "requestTimeEpoch": 1717401827750, "requestId": "9988efa9-sadff-4543-0000-asfsadf879yudh", "identity": { "cognitoIdentityPoolId": "None", "accountId": "None", "cognitoIdentityId": "None", "caller": "None", "sourceIp": "240.20.10.120" (this is not real), "principalOrgId": "None", "accessKey": "None", "cognitoAuthenticationType": "None", "cognitoAuthenticationProvider": "None", "userArn": "None", "userAgent": "curl/7.81.0", "user": "None" }, "domainName": "exampledomainname.execute-api.eu-west-1.amazonaws.com", "deploymentId": "8uohsd", "apiId": "exampleaPIid" }, "body": "None", "isBase64Encoded": false } }

As can you see, the event.requestContext.identity attributes are set as "None"..., and that's my problem, because I don't want to add the JWT module to check the Cognito JWT data because it will add some execution time and space... I know at least a year ago this worked directly...

I'm using the default template:

`## See https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html

This template will pass through all parameters including path, querystring, header, stage variables, and context through to the integration endpoint via the body/payload

#set($allParams = $input.params()) { "body-json" : $input.json('$'), "params" : { #foreach($type in $allParams.keySet()) #set($params = $allParams.get($type)) "$type" : { #foreach($paramName in $params.keySet()) "$paramName" : "$util.escapeJavaScript($params.get($paramName))" #if($foreach.hasNext),#end #end } #if($foreach.hasNext),#end #end }, "stage-variables" : { #foreach($key in $stageVariables.keySet()) "$key" : "$util.escapeJavaScript($stageVariables.get($key))" #if($foreach.hasNext),#end #end }, "context" : { "account-id" : "$context.identity.accountId", "api-id" : "$context.apiId", "api-key" : "$context.identity.apiKey", "authorizer-principal-id" : "$context.authorizer.principalId", "caller" : "$context.identity.caller", "cognito-authentication-provider" : "$context.identity.cognitoAuthenticationProvider", "cognito-authentication-type" : "$context.identity.cognitoAuthenticationType", "cognito-identity-id" : "$context.identity.cognitoIdentityId", "cognito-identity-pool-id" : "$context.identity.cognitoIdentityPoolId", "http-method" : "$context.httpMethod", "stage" : "$context.stage", "source-ip" : "$context.identity.sourceIp", "user" : "$context.identity.user", "user-agent" : "$context.identity.userAgent", "user-arn" : "$context.identity.userArn", "request-id" : "$context.requestId", "resource-id" : "$context.resourceId", "resource-path" : "$context.resourcePath" } }`

Thank you.

2 Answers
1
Accepted Answer

Well, after 8 changes between "proxy/not proxy" in the integration method, it started working... Maybe was a console problem.

answered 2 years ago
EXPERT
reviewed 2 years ago
EXPERT
reviewed 2 years ago
0

Are you using Lambda proxy API Gateway integration? You can view Cognito user information under requestContext, as shown below from the Lambda function:

{ "requestContext": { "resourceId": "fiulla", "authorizer": { "claims": { "origin_jti": "8c16e2dd44-04dd2e-4056-a31b-84103438961e", "sub": "04a80498-2dd021-7dd04b-f165-fb92baa4ec19", "aud": "2vnf41brk9n52ddmj1sne356bss9tg", "event_id": "547333ddda9-d203-46cd-addeb6-4d0914dc58b3", "token_use": "id", "auth_time": "171733478274", "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_n6eddqEffdIUI1", "cognito:username": "testUser", "exp": "Tue Jun 04 06:17:54 UTC 2024", "iat": "Tue Jun 04 05:17:54 UTC 2024", "jti": "7633ddffdds28412-4f5f-4817-b5aa-354dd0597780af" } } } }

AWS
answered 2 years ago
  • I tried with proxy integration couple of times (because I red sometimes Api Gateway fails and it is recommended to create other API and not only the method) but also returned empty data for Cognito User/Pool

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.