dherault / dherault/serverless-offline
clientCert property is undefined when client certificates are used
- Dominant language
- JavaScript
- Stars
- 5.3k
- Forks
- 811
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 3
Description
## Bug Report
**Current Behavior**
When a client certificate is used to call a lambda HTTP handler, the clientCert property of the event is undefined when the code runs on serverless-offline but the clientCert is defined when running on AWS.
**Sample Code**
Client code:
```
const ca = await fsPromises.readFile(workingDirectory('ca.pem'));
const cert = await fsPromises.readFile(workingDirectory('client.pem'));
const key = await fsPromises.readFile(workingDirectory('client.key'));
import { Client } from 'undici';
const apiClient = new Client(apiUrl, {
connect: { ca, cert, key },
});
const apiResponse = await apiClient.request({
path: '/',
method: 'POST',
body: JSON.stringify(payload),
});
```
Server code:
```module.exports = {
handler: async (event: APIGatewayProxyEvent, _context: Context, _callback: any) => {
logger.info({ event }, 'Event received');
// certificate info is a distinguished name in clientCert
// v1 is .identity.clientCert but v2 is .authentication.clientCert
if (!event.requestContext.identity?.clientCert)
throw new Error('A client certificate is required on this endpoint');
}
}
```
file: serverless.js
```
module.exports = {
configValidationMode: 'error',
service: 'myLambda',
plugins: ['serverless-offline'],
useDotenv: true,
custom: {
'serverless-offline': {
noPrependStageInUrl: true,
allowCache: true,
httpsProtocol: 'ssl',
},
},
provider: {
name: 'aws',
runtime: 'nodejs18.x',
timeout: 30,
stage: 'api',
region: 'ap-southeast-2',
environment: {
LOGGING_LEVEL: 'trace',
},
},
package: {
individually: true,
excludeDevDependencies: true,
exclude: ['**'],
},
functions: {
api: {
handler: `lib/index.handler`,
package: {
include: [`lib/index.js`, `node_modules/**`],
},
events: [
{
http: {
path: '/',
method: 'ANY',
cors: false,
},
},
],
},
},
};
```
**Expected behavior/code**
The error "'A client certificate is required on this endpoint" is not thrown.
**Environment**
- `serverless-offline` version: 12.0.4
- `node.js` version: 18.0.0
- `OS`: macOS 13.5.1
**Additional context/Screenshots**
Log output of `event` object from the code example above:
Contributor guide
Research direction
Reproduce the request using the serverless.js configuration and the handler at lib/index.handler, comparing the local event with AWS behavior. Trace where serverless-offline builds requestContext for HTTPS client-certificate requests. Done means the handler receives clientCert in the expected requestContext location and the provided certificate-required check no longer throws.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript, node.js
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100