- Newest
- Most votes
- Most comments
This is actually expected behavior and relates to how API Gateway handles static website content versus API endpoints. Let me explain:
When you deploy static files (like index.html) through API Gateway's S3 integration:
- These files are typically served through a special "GET /" integration
- API Gateway treats these as public static content by default
- The API key requirement is often bypassed for these static asset routes
When you hit the base URL (/stage/):
- This is treated as an actual API endpoint
- API key requirements are enforced as expected
- Hence you get the "forbidden" error
API keys are generally better suited for backend API access rather than securing web content.
To include an API Key in the API Gateway invoke URL for use in a browser without configuring it in the header, you can use the x-api-key query parameter. This method allows you to pass the API Key directly in the URL.
Here's how you can structure the URL:
https://your-api-gateway-url.com/stage/resource?x-api-key=your-api-key-here
However, please note that this approach is less secure than sending the API Key in the header, as the key will be visible in the URL. Use this method with caution and consider the security implications for your specific use case.
answered 2 years ago
It's weird...when I create the API key and enable as "API key required" as True and I put this in the browser: https://your-api-gateway-url.com/stage/index.html it still works without the API key. Why??
but doesn't work if I have in the browser: https://your-api-gateway-url.com/stage --> so here API key kicks in and the site gets "forbidden"...but with index.html appended along with API key, works even though there is API key is enforced...
answered 2 years ago
Relevant content
asked 2 years ago
asked 7 months ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated a year ago
It's weird...when I create the API key and enable as "API key required" as True and I put this in the browser: https://your-api-gateway-url.com/stage/index.html it still works without the API key. Why??
but doesn't work if I have in the browser: https://your-api-gateway-url.com/stage --> so here API key kicks in and the site gets "forbidden"...but with index.html appended along with API key, works even though there is API key is enforced...Thoughts?