CODEWITHSUNDEEP
pythonamazon-web-serviceswebsocketapi-gateway
Dymek
Dymek

Reputation: 1

Aws Websocket {"message":"Missing Authentication Token"}

anyone knows what's wrong with this code. The address from the api gateway returns {"message": "Missing Authentication Token"}. All code deploy by serverless framework on AWS.

JS custom.js

var socket;

// Connect to the WebSocket and setup listeners
function setupWebSocket(username, token) {
    socket = new ReconnectingWebSocket(" {api endpoint}?token=" + token);



    socket.onopen = function(event) {
        data = {"action": "getRecentMessages"};
        socket.send(JSON.stringify(data));
    };
        socket.onmessage = function(message) {
        var data = JSON.parse(message.data);
        data["messages"].forEach(function(message) {
            if ($("#message-container").children(0).attr("id") == "empty-message") {
                $("#message-container").empty();
            }
            if (message["username"] === username) {
                $("#message-container").append("<div class='message self-message'><b>(You)</b> " + message["content"]);
            } else {
                $("#message-container").append("<div class='message'><b>(" + message["username"] + ")</b> " + message["content"]);
            }
            $("#message-container").children().last()[0].scrollIntoView();
        });
    };
}
// Sends a message to the websocket using the text in the post bar
function postMessage(token){
    var content = $("#post-bar").val();
    if (content !== "") {
        data = {"action": "sendMessage", "token": token, "content": content};
        socket.send(JSON.stringify(data));
        $("#post-bar").val("");
    }
}

handler.py

def _send_to_connection(connection_id, data, event):
    gatewayapi = boto3.client("apigatewaymanagementapi",
                              endpoint_url="https://" + event["requestContext"]["domainName"] +
                                           "/" + event["requestContext"]["stage"])
    return gatewayapi.post_to_connection(ConnectionId=connection_id,
                                         Data=json.dumps(data).encode('utf-8'))

Upvotes: 0

Views: 1470

Answers (1)

Gareth McCumskey
Gareth McCumskey

Reputation: 1540

Contrary to the message, the issue is not actually a missing authentication token. API Gateway returns the same message when the endpoint you are accessing is not exactly correct; i.e. does not exist, probably due to some typo or slight misconfiguration. I would suggest confirming that your endpoint is valid and re-check that.

The reason you get this message is because if they returned a 404 it meant that you now know that the (invalid) endpoint you called does not exist. But that also means that you could do a brute force process of checking all possible endpoints and any not returning 404 do exist but behind some kind of firewall, authentication system or API Key. By returning 403 for all endpoints, even if they don't exist, AWS are improving their security posture. Its the same reason that on a login form you don't return a message such as "Username does not exist", because otherwise someone could find a way to find valid usernames based on your error message.

Hope that helps

Upvotes: 3

Related Questions