CODEWITHSUNDEEP
aws-lambdaaws-api-gatewayserverless-framework
Jim
Jim

Reputation: 1608

custom authorizers in Amazon API Gateway 500 error

I use Serverless-Authentication-boilerplate and want to map custom error response. But it always return 500 error.

authorize.js

// Authorize
function authorize(event, callback) {
  let providerConfig = config(event);
  try {
    let data = utils.readToken(event.authorizationToken, providerConfig.token_secret);
    console.log("Decrypted data: " + JSON.stringify(data));

    let methodArn = event.methodArn.replace(/(GET|POST|PUT|DELETE)/g, '*').replace(/mgnt.+/g, 'mgnt/*');

    console.log(`Change methodArn to: ${methodArn}`);

    // TODO: handle expiration time validation
    callback(null, utils.generatePolicy(
      data.id, // which is $context.authorizer.principalId
      'Allow',
      methodArn));
  } catch (err) {
    console.log(err);
    callback('401 Unauthenticated');
  }
}

s-function.json

responses:{ 
  "401 Unauthenticated.*": {
      "statusCode": "401"
  },
  "default": {
      "statusCode": "200",
      "responseModels": {
        "application/json;charset=UTF-8": "Empty"
      },
      "responseTemplates": {
        "application/json;charset=UTF-8": ""
      }
  }
}

Upvotes: 8

Views: 5329

Answers (2)

Mr.X
Mr.X

Reputation: 31335

If your custom auth lambda is not able to return the policy document, your APIs will return 500 error.

Use async await properly to get the right response. (Assuming your code is in Node.js)

The code I was trying to execute was returning before promises getting fulfilled. You have to make sure that the code returns after the promises are fulfilled only.

Test the authorizer from the test feature of API authorizers to get the exact error causing your custom authorizer API gateway pair to fail.

Upvotes: 0

Jim
Jim

Reputation: 1608

After ask to Amazon Web Services.

Unfortunately the mapping of the Authorizer is not currently configurable and every returned error from a lambda function will map to a 500 status code in API gateway. Moreover, the mapping is performed on an exact string match of the output, so, in order to return the intended 401 Error to the client, you should execute a call to 'context.fail('Unauthorized');.

Finally, I change 

callback('401 Unauthenticated');

to

context.fail('Unauthorized');

and work fine.

Sharing to whom may encounter this.

Upvotes: 12

Related Questions