CODEWITHSUNDEEP
authorizationaws-api-gatewayamazon-cognito
Clive Sargeant
Clive Sargeant

Reputation: 652

AWS ApiGateway cognito user pool authorization works without required id token

I am learning to use cognito, Lambda, DynamoDb and ApiGateway and am confused by the following:

i have set up an api gateway authorizer using my cognito user pool. testing it in the Authorizer window using an id token to authorize works. i then set the Authorization of the post method execution to use this authorizer, requiring an HTTP Authorization request header. if i then test the post method in the api gateway console, it works event though i do not input the required Authorization header value (id token)! is this correct? i would have thought that it would fail without the id token! - testing in Postman and from my web app fails as expected if i don't include the id token.

why does it work without the id token in the api gateway console?

Upvotes: 0

Views: 263

Answers (2)

Bob Kinney
Bob Kinney

Reputation: 9020

As noted on the AWS Forums test invoke does not test your method's authorization mechanism.

Upvotes: 1

UXDart
UXDart

Reputation: 2620

I think the console bypass the authoriser, is to test the lambda method, not the authoriser

Upvotes: 2

Related Questions