apigateway.RequestAuthorizer: pass request body to authorizer function
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the feature
Add the ability to pass the incoming event body into a custom authorization function.
### Use Case
For certain authorization processes (e.g., some signature-based authorization mechanisms), oftentimes the request body is required (and abstracted away from a developer's control to add to headers). As a result, it is required in certain circumstances to pass this event body into a custom authorization function.
### Proposed Solution
As we can currently do with the headers of a request, add the ability to do the same with the event body.
```
const customAuthorizerFunction = new apigateway.RequestAuthorizer(
this,
`${bot.namespace}CustomAuthorizerFunction`,
{
handler: authorizerFunction,
identitySources: [apigateway.IdentitySource.header("X-Slack-Signature"), apigateway.IdentitySource.body],
resultsCacheTtl: cdk.Duration.seconds(0),
}
)
```
### Other Information
Not sure if this is even a possibility with the underlying apigw lambda authorizer setup or if this approach/ design makes sense in the long term but it would be awesome if in some way we can get that event body into the authorizer function!
Also, apologies if this is already possible with cdk! I did some digging in docs around this construct and some of the adjacent ones it touches/ stack overflow searching and could find anything about how to get it setup!
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.113.0
### Environment details (OS name and version, etc.)
MacOS 14.1.2
Contributor guide
Research direction
Start with the apigateway.RequestAuthorizer and IdentitySource APIs, then verify whether the underlying API Gateway Lambda authorizer setup supports the request body as an identity source. Done means a supported configuration can make the incoming event body available to the custom authorizer, or the limitation and alternatives are documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100