another way to get the session token?

Question

When a user wants to purchase my saas, AWS spawns a copy of my app and includes a token in the header. I need to use that token to call ResolveCustomer(). But AWS is not calling my app directly. Instead, due to security needs AWS spawns a copy of OneLogin/SAML where it checks the users authentication. After the authentication, OneLogin/SAML spawns my application. The problem is that OneLogin is not forwarding the token to my application. So my app cannot run ResolveCustomer() to continue the handshake between AWS and my App. OneLogin is running in a different process than my application.

I have tried stuffing the token into a cookie for my application to use but there are limitations on sending two cookies at once in PHP. So, besides using a cookie, is there any AWS sdk function that will allow my app to request the cookie, rather than through the POST?

I have tried stuffing the token  into a cookie for my application to use but there are limitations on sending two cookies at once in PHP.  So, besides using a cookie, is there any AWS sdk function that will allow my app to request the cookie, rather than through the POST?

Bryant Pollard · Answer

While I don't have a direct answer, I do have guidance that may help. Consider manipulating post and cookie information using CloudFront. Through Lambda@Edge functions you can read and manipulate the http request body, header, and cookies. This occurs before the request traffic reaches your application.

Hope this helps, please approve this answer if it does

another way to get the session token?

Relevant content