AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
Lambda not receiving claims from API Gateway Cognito Authorizer
I'm really confused over the request context I am getting from API Gateway in my .NET 8 lambda using a Cognito Authorizer. The Cognito authorizer is working, I can paste the token into Postman and it lets me call the API. If I leave it out or corrupt the token, API Gateway properly denies access.
But my understanding is RequestContext.Authorizer.Jwt is supposed to include the claims on the token. Instead it is coming through as Null.
Any ideas on what is going on? There aren't really many configurable options around the Cognito Authorizer, so I can't see what I'm doing wrong. I thought maybe it was a deserialization problem with AoT compiling, so I added all of the request context related classes to the source-generation serialization context class and it didn't seem to help. I would expect an exception anyways if AoT serialization was causing issues (I think).
Attached is a copy of what I'm seeing in my logs
- Newest
- Most votes
- Most comments
When using a Cognito User Pool authorizer, the claims are not automatically included in RequestContext.Authorizer.Jwt. You can get the token from the Authorization header, decode it using a JWT library, and access the attributes. Also, when compiling with AoT, using JsonSerializer.Deserialize can cause issues leading to null values. You could use source generation for native AOT applications to resolve this. If these suggestions don’t resolve the issue, consider reaching out to AWS Support or the AWS Developer Forums.
Relevant content
asked 2 years ago
Thanks for the quick response Giovanni. That clarification makes sense with what I am seeing; I do have the Bearer token on the headers. I'm sure that difference is documented, I kept pouring over the documentation and didn't see it called out. I find the documentation confusing, it lists Lambda, JWT, and IAM authorizers but not Cognito Authorizers. In their examples they use Cognito with the JWT authorizer. And the Console and CDK don't have JWT authorizers from what I can find, but they do have the Cognito authorizers... so I was working on the assumption they are one and the same and using their JWT authorizer, I guess not.
Jwt is one per exchange keys
https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-jwt-authorizer.html
Sometimes you have to work around it as not all services support it natively