dherault / dherault/serverless-offline

Authorization fails when having pathParameters and set one of them fixed when building the policy

Open
#1,586 5 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
5.3k
Forks
811
Avg merge
2d 4h
Merged PRs (30d)
3

Description

## Bug Report

I don't complete know if it's a bug, wrong usage or "feature" but it has to do with #1043 which is closed with actually no comment and a related PR (#1283) which addresses the issue is also closed for being old and without tests.

**Current Behavior**

We're unable to authorise when using path parameters and limiting resource access in a policy because when we're building the policy we use a defined value instead of a wildcard which fails when the check of matching policy resource is done.

When a user is calling the path `base/pathParam1/pathParam2/pathParam3` we create a custom policy in the custom authorizer where we set `pathParam1` to a defined value for that user and `pathParam1` and `pathParam2` are defined in a wildcard, e.g. `GET/base/*/fixedUserValue/*`. Before the change of #980 it worked because the `authMatchPolicyResource` would receive the translated path where all path parameters are replaced and the `regExp.test` succeeds.

So basically before #980 the behaviour was to check resource`arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/pathParam1/pathParam2/pathParam3` against policyResource `arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/base/*/pathParam2/*`.
After the change the resource has changed to `arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/base/{param1}/{param2}/{param3}` which clearly fails.

**Sample Code**

- file: serverless.yml

```yaml
service: my-service

plugins:
- serverless-offline

provider:
runtime: nodejs16.x
stage: dev

functions:
api-authorizer:
name: api-authorizer
handler: app/functions/api-authorizer.handler

testing-endpoint:
name: testing-endpoint
handler: app/handlers/SomeHandler.handler
events:
- http:
path: "base/{param1}/{param2}/{param3}"
method: get
request:
parameters:
paths:
param1: true
param2: true
param3: true
authorizer:
name: api-authorizer
```

- file: api-authorizer.ts

```ts
export class ApiAuthorizer {
public async authorize(event, context) {
// some auth stuff
const principalId = 'principal123';

const policyDocument = {
Statement: [
{
Action: 'execute-api:Invoke',
Effect: 'Allow',
Resource: 'arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/base/*/fixedUserValue/*',
},
],
Version: '2012-10-17',
}

return {
context, principalId, policyDocument
}
}
}
```

**Expected behavior/code**

Successful authorization ` Authorization function returned a successful response`.

I can reproduce above behaviour in the integration test suite.

We're running the same custom authorizer on production which hasn't got the issue.

**Environment**

- `serverless` version: 3.22
- `serverless-offline` version: v8.8.1
- `node.js` version: v16
- `OS`: MacOs

Contributor guide

Open the contributing guide

Research direction

Start with the integration test suite, reproducing the path-parameter authorizer case from serverless.yml and api-authorizer.ts. Trace authMatchPolicyResource and compare the resource values before and after #980. Done means the fixed path-parameter policy authorizes successfully and the integration suite includes a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
api, authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.