serverless / serverless/examples
API Gateway Authorizer - IAM policy not caching
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 11.5k
- Forks
- 4.4k
- Avg merge
- 2h 55m
- Merged PRs (30d)
- 3
Description
I am trying to cache the IAM policy returned by the authorizer lambda when it validates the JWT token for the first time. I have enabled and set the authorizerResultTtlInSeconds to 3500 seconds in API Gateway Authorizer. However, I still see a request going to the Authorizer lambda function within the caching time frame as this shouldn't happen due to caching.
My node.js script is as below:
const jwt = require('jsonwebtoken');
const jwksClient = require('jwks-rsa');
const keyClient = jwksClient({
jwksUri: process.env.JWKS_URI
})
const allow = {
"principalId": "user",
"policyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "execute-api:Invoke",
"Effect": "Allow",
"Resource": process.env.RESOURCE // RESOURCE = *
}
]
}
}
const unauthorized = {
"error": "Unauthorized",
}
//excluded verificationJWTOptions object and getSigningKey function for simplicity
function validateJWTToken(token, callback) {
jwt.verify(token, getSigningKey, verificationJWTOptions, (error) => {
if (error) {
callback(unauthorized)
} else {
callback(null, allow)
}
})
}
exports.handler = (event, context, callback) => {
const token = extractTokenFromHeader(event);
validateJWTToken(token, callback);
}
Not sure what I am missing out. Any help would be much appreciated!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file or test is named; the issue provides only an inline Node.js authorizer handler. Start by reviewing the API Gateway Authorizer configuration and the shown exports.handler and validateJWTToken flow, then reproduce requests within the 3500-second TTL. Done means identifying why the authorizer is invoked during the configured caching window and documenting the verified behavior or required configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript, node.js
- Domain
- api, authentication, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100