lambda-auth | authenticated data structures | Natural Language Processing library

There are two possible problems.

1. The response is incorrect for a custom authorizer for a REST API (which is what the http event is in serverless). Output from an Amazon API Gateway Lambda authorizer shows what the output should look like, as well as what is required.
2. You intended to use an HTTP API. In that case you should change the event to httpApi: Announcing Support for AWS HTTP APIs

I tried to replicate that issue using my own API Gateway, and I haven't identified any problems with your lambda function. It works as expected.

Example of authorized call:

Amazon API Gateway offers two types of APIs: REST APIs and HTTP APIs. REST APIs were the kind of APIs originally introduced with Amazon API Gateway, while HTTP APIs got just announced at the end of 2019.

Based on the description of your OpenAPI specification I assume you're trying to deploy a REST API. The x-amazon-apigateway-cors OpenAPI extension however only works for HTTP APIs.

You have two choices now: You either switch to use a HTTP API or you configure CORS manually. As long as you don't need features only supported by REST APIs, I suggest you switch to use a HTTP API, as that's the more modern kind of API Amazon API Gateway offers.

If you want to use a REST API, enabling CORS is requires more manual configuration. That's documented by AWS in Enabling CORS for a REST API resource. Essentially you have to ensure your integration returns proper CORS headers. For a NodeJS AWS Lambda function that could look like:

This is a bit tricky and it takes from me around a day to get all set.

First we have options here:

• Instead of authentication we can sign the URL and return a signed CloudFront URL or signed S3 URL and it's pretty straight forward but obviously that not what I was looking for.
• The second option is to use Lambda@Edge to authorize the requests of the CloudFront and that what I followed.

So I ended up create a separate stack to handle all the S3, CloudFront, and Lambda@Edge stuff cause they are all deployed on edges which means that the region doesn't matter but for lambda edge we need to deploy it to the main AWS region ((N. Virginia), us-east-1) So i ended up creating one stack for all of them.

First I have the below code in my auth-service.js (It's just some helpers to allow me to verify my custom jwt):

Implement JWT Token approach.You will need an authentication provider that will return you the token. Example of authentication provider is Auth0 or you can roll out your own.

The flow would be:

1. Your client will perform user authentication with this provider. The provider will return the token to your client. The client need to pass the token via Authorization header in your request payload to API Gateway.

2. API Gateway will call Lambda Authorizer to authorize / validate the token. The Lambda Authorizer code must verify the token with the authentication provider and once authorized will return a policy that allows the API call to be made.

Replicated functions are something Lambda@Edge uses, so I assume that's the case here even though it's not stated. You should review this document on how to delete these. You can't manually delete them at this time:

You can delete a Lambda@Edge function only when the replicas of the function have been deleted by CloudFront. Replicas of a Lambda function are automatically deleted in the following situations:

After you have removed the last association for the function from all of your CloudFront distributions. If more than one distribution uses a function, the replicas are removed only after the function is disassociated from the last one.

After you delete the last distribution that a function was associated with.

Replicas are typically deleted within a few hours.

Note:

Replicas cannot be manually deleted at this time. This helps prevent a situation where a replica is removed that you're still using, which would result in an error.

From what I've read (some code samples would be helpful) it sounds like you're not calling the callback right or it's not called in the right place. You can use

callback("Some error message.");

to send back a response w/ a 401 status code. You can also change this by doing something like:

After lots of hours testing different things found by Internet, I started to have improvements when I noticed that the policy document was wrong:

Before

I had the same issue that you describe. Or at least I think so. And I managed to get it solved by following the documentation on links you provided.

The serverless documentation states for the authorizer format to be