dherault / dherault/serverless-offline

Purpose of env.AUTHORIZER

Open
#1,764 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
5.3k
Forks
811
Avg merge
2d 4h
Merged PRs (30d)
3

Description

I'm curious about the full purpose of `env.AUTHORIZER` for mocking remote authorizers. From what I can tell, even with that environment variable set the authorizer is still validated and ran, but then the authorizer result is discarded in favor of the mocked value in the environment variable. It seems there'd be value in bypassing the entire authorization process and just immediately returning the mocked value to support use-cases that currently don't work. I can't tell if this was the intent of the environment variable or if the current functionality is preferred.

For example, the following use-case doesn't work since it relies on referencing an authorizer function by ARN:

```
provider:
name: aws
httpApi:
authorizers:
httpApiAuthorizer:
type: request
functionArn: arn:aws:lambda:...
resultTtlInSeconds: 0

functions:
httpTestCall:
handler: src/testCall.handler
events:
- httpApi:
method: GET
path: /test
authorizer:
name: httpApiAuthorizer
```

However, if `env.AUTHORIZER` skipped hooking up the actual authorizer, it wouldn't matter what authorizer was used since the result is mocked anyway.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.