6

My API Gateway is configured to invoke my custom authorizer Lambda function when authorizing requests.

For requests which bear an authentication token, the Lambda function decrypts and decodes the JWT token, and does some verification, before passing the request upstream. If token verification fails, the authorizer short-circuits the request with a 401 Unauthorized.

For requests which do not bear an authentication token, the function merely allows the request through (generates an Allow policy.) It is the responsibility of the gateway's upstreams to decide if a given request requires authentication (still, token decryption / decoding / validation is sanely encapsulated in the gateway, vs. implemented in each upstream.)

My question is: for unauthenticated requests, which my gateway / authorizer "allow", what is an appropriate value for the allow policy's principal ID? I don't seem to have the option to leave it undefined.

Moreover, are there any risks if I have principal ID re-use between multiple, unrelated requests? Supposing X percent of requests share the 'unauthenticated' principal ID, is there any risk of, as a worst case example, some kind of behavioral "collisions" between these otherwise unrelated requests? Perhaps a risk-averse / future-proof solution would be to simply append a UUID suffix: 'unauthenticated|{uuid}'.

https://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html

In addition to returning an IAM policy, the custom authorizer function must also return the caller's principal identifier.

2
  • 1
    Good question. I couldn't find clear documentation of what the principal ID is used for, though I suspect it's just for caching the authorization response and for logs. There's probably no risk in a shared principal ID if all unauthorized users have the same access, but I opted for a UUID because I wasn't certain.
    – Kevin
    Dec 4, 2018 at 0:49
  • Note that custom authorizers don't allow empty token values: "If a specified identify source is missing, null, or empty, API Gateway returns a 401 Unauthorized response without calling the authorizer Lambda function". See: docs.aws.amazon.com/apigateway/latest/developerguide/… To deal with this, I used a placeholder Authorization header value for unauthorized users that generates the "unauthorized" policy document.
    – Kevin
    Dec 4, 2018 at 0:51

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.