Authorization header (what about in form parameter?)

Question

We currently support Authorization being passed in the header.  
  
But we have one customer saying that they cannot pass header parameter and can only pass form parameter.  
  
How can we enforce Auth if authorization is coming from form parameters?  
  
Note: we are using Hydra as OAuth2 server

Answer

>    
 >when you say Integration... you mean like in a Lambda Integration  
  
Correct. Apologies for the inconvenience.  
  
Regards,  
Bob

Answer

Hello:  
  
Unfortunately there is currently no native authorization in API Gateway that supports access to the payload (where form parameters would be present). You would have to pass this information to your integration and authorize the request in your integration.  
  
Regards,  
Bob

Answer

when you say Integration... you mean like in a Lambda Integration. I will be checking the client credentials against hydra in one of the Lambda itself  
  
that is exactly what I am thinking. But having doubts if it beats the best practices  
unfortunately, we need to support the customer's needs

Authorization header (what about in form parameter?)

相關內容