aws / aws/aws-cdk

apigateway.RequestAuthorizer: pass request body to authorizer function

Open
#28,248 18 comments 32 reactions 0 assignees View on GitHub
@aws-cdk/aws-apigateway effort/medium feature-request p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the feature

Add the ability to pass the incoming event body into a custom authorization function.

### Use Case

For certain authorization processes (e.g., some signature-based authorization mechanisms), oftentimes the request body is required (and abstracted away from a developer's control to add to headers). As a result, it is required in certain circumstances to pass this event body into a custom authorization function.

### Proposed Solution

As we can currently do with the headers of a request, add the ability to do the same with the event body.

```
const customAuthorizerFunction = new apigateway.RequestAuthorizer(
this,
`${bot.namespace}CustomAuthorizerFunction`,
{
handler: authorizerFunction,
identitySources: [apigateway.IdentitySource.header("X-Slack-Signature"), apigateway.IdentitySource.body],
resultsCacheTtl: cdk.Duration.seconds(0),
}
)
```

### Other Information

Not sure if this is even a possibility with the underlying apigw lambda authorizer setup or if this approach/ design makes sense in the long term but it would be awesome if in some way we can get that event body into the authorizer function!

Also, apologies if this is already possible with cdk! I did some digging in docs around this construct and some of the adjacent ones it touches/ stack overflow searching and could find anything about how to get it setup!

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.113.0

### Environment details (OS name and version, etc.)

MacOS 14.1.2

Contributor guide

Open the contributing guide

Research direction

Start with the apigateway.RequestAuthorizer and IdentitySource APIs, then verify whether the underlying API Gateway Lambda authorizer setup supports the request body as an identity source. Done means a supported configuration can make the incoming event body available to the custom authorizer, or the limitation and alternatives are documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
api, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.