boyney123 / boyney123/cdk-eventbridge-socket

Add a authorizer function for the API Gateway (Websocket) endpoint

Open
#1 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
52
Forks
10
PR merge metrics
No merged PRs in 30d

Description

By default the websocket is open for anyone to connect too.

Think it would be better practice if there was a basic lambda that maybe could verify a token of some sort? Like the example seen here https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html

```js
exports.handler = async(event) => {
let response = {
"isAuthorized": false,
"context": {
"stringKey": "value",
"numberKey": 1,
"booleanKey": true,
"arrayKey": ["value1", "value2"],
"mapKey": {"value1": "value2"}
}
};

if (event.headers.authorization === "secretToken") {
response = {
"isAuthorized": true,
"context": {
"stringKey": "value",
"numberKey": 1,
"booleanKey": true,
"arrayKey": ["value1", "value2"],
"mapKey": {"value1": "value2"}
}
};
}

return response;

};
```

Maybe the websocket could send a authorization header, then we could allow the connection if it matches....

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the API Gateway WebSocket endpoint and the linked AWS Lambda authorizer example. Determine how this construct configures connection authorization and define which token or authorization header should be accepted; done means unauthorised connections are rejected while valid ones are allowed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
api, authentication, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.