dherault / dherault/serverless-offline

clientCert property is undefined when client certificates are used

Open
#1,730 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
5.3k
Forks
811
Avg merge
2d 4h
Merged PRs (30d)
3

Description

## Bug Report

**Current Behavior**

When a client certificate is used to call a lambda HTTP handler, the clientCert property of the event is undefined when the code runs on serverless-offline but the clientCert is defined when running on AWS.

**Sample Code**

Client code:
```
const ca = await fsPromises.readFile(workingDirectory('ca.pem'));
const cert = await fsPromises.readFile(workingDirectory('client.pem'));
const key = await fsPromises.readFile(workingDirectory('client.key'));

import { Client } from 'undici';
const apiClient = new Client(apiUrl, {
connect: { ca, cert, key },
});
const apiResponse = await apiClient.request({
path: '/',
method: 'POST',
body: JSON.stringify(payload),
});
```

Server code:
```module.exports = {
handler: async (event: APIGatewayProxyEvent, _context: Context, _callback: any) => {
logger.info({ event }, 'Event received');
// certificate info is a distinguished name in clientCert
// v1 is .identity.clientCert but v2 is .authentication.clientCert
if (!event.requestContext.identity?.clientCert)
throw new Error('A client certificate is required on this endpoint');
}
}
```

file: serverless.js
```
module.exports = {
configValidationMode: 'error',
service: 'myLambda',
plugins: ['serverless-offline'],
useDotenv: true,
custom: {
'serverless-offline': {
noPrependStageInUrl: true,
allowCache: true,
httpsProtocol: 'ssl',
},
},

provider: {
name: 'aws',
runtime: 'nodejs18.x',
timeout: 30,
stage: 'api',
region: 'ap-southeast-2',
environment: {
LOGGING_LEVEL: 'trace',
},
},

package: {
individually: true,
excludeDevDependencies: true,
exclude: ['**'],
},

functions: {
api: {
handler: `lib/index.handler`,
package: {
include: [`lib/index.js`, `node_modules/**`],
},

events: [
{
http: {
path: '/',
method: 'ANY',
cors: false,
},
},
],
},
},
};
```

**Expected behavior/code**

The error "'A client certificate is required on this endpoint" is not thrown.

**Environment**

- `serverless-offline` version: 12.0.4
- `node.js` version: 18.0.0
- `OS`: macOS 13.5.1

**Additional context/Screenshots**

Log output of `event` object from the code example above:
image

Contributor guide

Open the contributing guide

Research direction

Reproduce the request using the serverless.js configuration and the handler at lib/index.handler, comparing the local event with AWS behavior. Trace where serverless-offline builds requestContext for HTTPS client-certificate requests. Done means the handler receives clientCert in the expected requestContext location and the provided certificate-required check no longer throws.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript, node.js
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.