Ggtcf

I have created a Lambda Authorizer on a AWS API Gateway, which calls a Lambda Function. Following is the code in the Lambda Function written in Node.js 8.0 code.

exports.handler = function(event, context, callback) 
 var token = event.authorizationToken;
 switch (token.toLowerCase()) 
 case 'allow':
 callback(null, generatePolicy('user', 'Allow', event.methodArn));
 break;
 case 'deny':
 callback(null, generatePolicy('user', 'Deny', event.methodArn));
 break;
 case 'unauthorized':
 callback("Unauthorized"); // Return a 401 Unauthorized response
 break;
 default:
 callback("Error: Invalid token"); 
 
;

// Help function to generate an IAM policy
var generatePolicy = function(principalId, effect, resource) 
 var authResponse = ;

 authResponse.principalId = principalId;
 if (effect && resource) 
 var policyDocument = ;
 policyDocument.Version = '2012-10-17'; 
 policyDocument.Statement = [];
 var statementOne = ;
 statementOne.Action = 'execute-api:Invoke'; 
 statementOne.Effect = effect;
 statementOne.Resource = resource;
 policyDocument.Statement[0] = statementOne;
 authResponse.policyDocument = policyDocument;
 

 // Optional output with custom properties of the String, Number or Boolean type.
 authResponse.context = 
 "stringKey": "stringval",
 "numberKey": 123,
 "booleanKey": true
 ;
 return authResponse;

(The above sample code if from the web site https://markpollmann.com/lambda-authorizer/)

If I save and Test this function by passing an invalid value for authorizationToken, I get expected result which is below.

Response:

 "errorMessage": "Error: Invalid token"


Request ID:
"e93567c0-fcbb-4cb1-b0b3-28e9c1b30162"

But If I call this API from Postman, by passing the value in the header, I get the following response. I am getting this error for any value in the header i.e, deny, allow, unauthorized, wrong etc.

 "message": null

The status message in postman shows "500 Internal Server Error". Following is the detail from header section in postman.

content-length →16
content-type →application/json
date →Fri, 08 Mar 2019 14:07:57 GMT
status →500
x-amz-apigw-id →W89kFDRDoEFxYg=
x-amzn-errortype →AuthorizerConfigurationException
x-amzn-requestid →92f31d11-41ab-11e9-9c36-97d38d96f31b

I do not understand why the API is returning the above response and error message, while the Lambda test is working fine.

I have already gone through the following two threads in SO, but the answers/comments couldn't help in my case.

AWS API Gateway with custom authorizer returns AuthorizerConfigurationException
AWS API Gateway Custom Authorizer AuthorizerConfigurationException

You cannot simply access event.methodArn from your event object inside your Lambda function.

When you test it from the console, the exact JSON you are providing to your Lambda function is going to be injected in your event object, however, when the call is proxied through API Gateway, you will then need to access the Event published by API Gateway and grab the field that you want.

I have no clue over your header's name, but let's say you named it my-cool-header. It would then be accessible via event.headers['my-cool-header'] from within your Lambda function.

Your switch block would then become:

switch (token.toLowerCase()) 
 case 'allow':
 callback(null, generatePolicy('user', 'Allow', event.headers['my-cool-header']));
 break;
 case 'deny':
 callback(null, generatePolicy('user', 'Deny', event.headers['my-cool-header']));
 break;
 case 'unauthorized':
 callback("Unauthorized"); // Return a 401 Unauthorized response
 break;
 default:
 callback("Error: Invalid token"); 
 

Similarly, if you wanted to send it on the body of your POST request, it would then be accessible via JSON.parse(event.body).myCoolField (body objects always come as stringified JSONs) and so on.

EDIT

I had missed one line on the original answer, which was trying to access event.authorizationToken - this is the same problem as the one cited above - therefore the code needs to be changed to const token = event.headers.authorizationToken if coming via Header, const token = JSON.parse(event.body).authorizationToken if coming from the body or const token = event.queryStringParameters.authorizationToken if coming from request parameters.

EDIT 2: The above fixed the issue. However, here's a simplified version of the code:

'use strict';

module.exports.handler = async (event) => 
 const token = event.headers.authorizationToken;
 switch (token.toLowerCase()) 
 case 'allow':
 return 
 statusCode: 200,
 body: JSON.stringify(generatePolicy('user', 'Allow', event.headers.methodArn))
 
 case 'deny':
 return 
 statusCode: 200,
 body: JSON.stringify(generatePolicy('user', 'Deny', event.headers.methodArn))
 
 default:
 return 
 statusCode: 400,
 body: 'No token'
 
 


// Help function to generate an IAM policy
const generatePolicy = (principalId, effect, resource) => 
 const authResponse = ;

 authResponse.principalId = principalId;
 if (effect && resource) 
 const policyDocument = ;
 policyDocument.Version = '2012-10-17';
 policyDocument.Statement = [];
 const statementOne = ;
 statementOne.Action = 'execute-api:Invoke';
 statementOne.Effect = effect;
 statementOne.Resource = resource;
 policyDocument.Statement[0] = statementOne;
 authResponse.policyDocument = policyDocument;
 

 // Optional output with custom properties of the String, Number or Boolean type.
 authResponse.context = 
 "stringKey": "stringval",
 "numberKey": 123,
 "booleanKey": true
 ;
 return authResponse;

Here's a proof of the working code:

I have understood the reason why I was getting message = null for the invalid input. The default block in the switch case was using parameter "Error: Invalid token" in the callback() method. API Gateway only identifies "Allow", "Deny" and "Unauthorized" as valid values. These values are also case sensitive. If any string values other than these values are passed to the callback() method, then API Gateway will return message=null to the client.