Authorizers (JWT, Lambda, Cognito) - AWS Serverless

1. Introduction

In AWS API Gateway, authorizers provide a way to control access to your APIs. This lesson will cover three main types of authorizers: JSON Web Tokens (JWT), Lambda authorizers, and Amazon Cognito authorizers.

2. Key Concepts

• Authentication: Verifying the identity of a user or service.
• Authorization: Granting or denying access to resources based on the authenticated identity.
• Tokens: Small pieces of data used for authentication and authorization.

3. JSON Web Tokens (JWT)

JWT is a compact and self-contained way for securely transmitting information between parties as a JSON object. It's commonly used for authentication and information exchange.

3.1 Structure of JWT

A JWT consists of three parts:

• Header: Contains metadata about the token, including the type and signing algorithm.
• Payload: Contains the claims or the actual data you want to transmit.
• Signature: Used to verify that the sender of the JWT is who it claims to be and to ensure that the message wasn't changed along the way.

3.2 Example JWT Creation

const jwt = require('jsonwebtoken');

const payload = {
    userId: 123,
    role: 'admin'
};

const secret = 'your-256-bit-secret';
const token = jwt.sign(payload, secret, { expiresIn: '1h' });

console.log(token);
            

4. Lambda Authorizers

Lambda authorizers allow you to use a Lambda function to authorize requests. You can implement custom authentication and authorization logic in your Lambda function.

4.1 Creating a Lambda Authorizer

Follow these steps to create a Lambda authorizer:

1. Create a new Lambda function in the AWS Lambda console.
2. Write your authorization logic in the Lambda function.
3. Configure the API Gateway to use your Lambda function as an authorizer.

4.2 Example Lambda Authorizer

exports.handler = async (event) => {
    const token = event.authorizationToken; // Get the token
    // Validate the token here (e.g., using JWT)
    
    const principalId = 'user|a1b2c3'; // The user identifier
    const policyDocument = {
        Version: '2012-10-17',
        Statement: [
            {
                Action: 'execute-api:Invoke',
                Effect: 'Allow',
                Resource: event.methodArn,
            },
        ],
    };

    return {
        principalId,
        policyDocument,
    };
};
            

5. Cognito Authorizers

Cognito authorizers allow you to leverage Amazon Cognito to handle user authentication and authorization.

5.1 Setting Up Cognito

1. Create a new user pool in Amazon Cognito.
2. Define the app client and configure settings.
3. Set up the API Gateway to use Cognito User Pool as an authorizer.

5.2 Example Cognito Configuration

In the API Gateway console, select your API, and under "Authorizers", create a new authorizer and choose "Cognito" as the type. Then, select your user pool.

6. Best Practices

• Use HTTPS to protect the data transmitted between clients and servers.
• Set short expiration times for tokens to minimize risk in case of token theft.
• Regularly rotate secrets and keys used in your authorization logic.

7. FAQ