By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Remapped header from AWS Lambda response

1

I have a web app with HTTP API deployed on AWS Lambda. The Lambda has both AWS API Gateway proxy integration and function URL. I'm calling it directly using function URL, without API Gateway. One of the endpoints uses basic HTTP authentication and returns 401 in case of invalid credentials. I'm adding "WWW-Authenticate" header set to "Basic" to the 401 response, so that web browser can handle it properly. The problem is that the header in response is remapped to "x-amzn-Remapped-www-authenticate".

I found an information that using API Gateway it's expected behaviour, but I cannot find any info how it should work using function URL directly. Is there any way to fix it and disable header remapping?

Topics
ServerlessCompute
Tags
AWS Lambda
Language
English
Mieszko
asked a year ago1104 views
2 Answers
2

Ref Links:

The remapping of certain HTTP headers, such as "WWW-Authenticate", to "x-amzn-Remapped-*" is designed to prevent certain types of potential security vulnerabilities.

However, the AWS API Gateway is able to return headers without remapping. Therefore, when a service like AWS Lambda is integrated with AWS API Gateway, it's possible to have more control over HTTP headers. AWS API Gateway can add or modify HTTP headers before the client receives them.

In your specific case, since you're invoking the Lambda function directly using its ARN, the function's response will always be subject to Lambda's automatic header remapping. One workaround could be to use AWS API Gateway even though you are currently avoiding it.

profile picture
EXPERT
Sedat Salman
answered a year ago
  • Mieszko
    a year ago

    Using API gateway is also okay, as long as I it doesn't remap the header. How to do it? Is it doable without custom lambda authorizer and having a proxy integration?

1

Yes, both API gateway and Lambda function url remap "WWW-Authenticate" to "x-amzn-Remapped-www-authenticate" in case of 401. If you are using cloud front then one possible way could be to move your basic authentication to cloudfront lambda@edge.

AWS
dinsajwa
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content