12

I'm build an API using AWS SAM (Lambda & API Gateway) whose contract is defined by a 3rd party.

The 3rd party calls my API with a GET request that contains JSON in the body. However, when a request is sent to the API with a body it gets rejected by CloudFront.

This is the request:

curl -X GET -H "Content-Type: application/json" --data '{"hello":"world"}' https://my-api.execute-api.us-east-2.amazonaws.com/Prod/my-api

This is the response:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML>
    <HEAD>
        <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
        <TITLE>ERROR: The request could not be satisfied</TITLE>
    </HEAD>
    <BODY>
        <H1>403 ERROR</H1>
        <H2>The request could not be satisfied.</H2>
        <HR noshade size="1px">
Bad request.


        <BR clear="all">
        <HR noshade size="1px">
        <PRE>
Generated by cloudfront (CloudFront)
Request ID: 1p0St_-e3noQL-2uMxeB_2I6lkMr1mg5afvxJRmVpCdnG67Vgnhj9w==
</PRE>
        <ADDRESS></ADDRESS>
    </BODY>
</HTML>

Checking the logs, the request never hits API Gateway or the Lambda function. However, if I remove the body from the request, then it hits the Lambda function and I get the appropriate error message from the API (telling the caller that the expected body is missing.)

curl -X GET -H "Content-Type: application/json" https://my-api.execute-api.us-east-2.amazonaws.com/Prod/my-api

I'm using basic configuration of API Gateway via a SAM template. This is the relevant section:

MyApiFunction:
  Type: AWS::Serverless::Function
  Properties:
    CodeUri: bin/main.zip
    Handler: main
    Runtime: go1.x
    Tracing: Active
    Role: !Sub ${MyApiLambdaExecutorRole.Arn}
    Events:
      CatchAll:
        Type: Api
        Properties:
          Path: /my-api
          Method: GET
4
  • See this post. That is illegal according to the RFC.
    – stdunbar
    Commented Dec 14, 2018 at 22:19
  • I'm subscribing to a 3rd party's Webhooks and the 3rd party issues this request to verify that my API is responding. I understand the objection to GET requests that contain a body, but I have no control over it. If there is no workaround then my only option is to move my API off AWS entirely. Commented Dec 14, 2018 at 22:56
  • I understand your frustration but AWS is implementing the standard. Try to create some code on an EC2 and maybe you can find something that will allow it. I know you're caught in the middle but it's going to be a tough one to solve other than to tell the 3rd party that they are breaking things.
    – stdunbar
    Commented Dec 14, 2018 at 23:05
  • I just proved to myself that, at least in Java with JAX-RS, I can get the body from a GET call. It's a bit convoluted but it can be done.
    – stdunbar
    Commented Dec 14, 2018 at 23:40

1 Answer 1

14

GET requests cannot contain a request body on CloudFront. Try using POST instead.

If you want to send limited data in a GET request, you can use query parameters.

You can see in the AWS Docs that this isn't possible here:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#RequestCustom-get-body

If a viewer GET request includes a body, CloudFront returns an HTTP status code 403 (Forbidden) to the viewer.

You could perhaps use an EC2 instance or other service that doesn't use API Gateway to handle the request.

9
  • Thanks, but a 3rd party specifies the API contract, so I cannot change what the request looks like. I can't send a POST or just query parameters instead. Commented Dec 14, 2018 at 22:15
  • 1
    Then the 3rd party needs to change the contract. Most servers do not support GET requests with a body. That's pretty standard practice.
    – Dave S
    Commented Dec 14, 2018 at 22:48
  • You can find more detailed information on the subject here: stackoverflow.com/questions/978061/http-get-with-request-body
    – Dave S
    Commented Dec 14, 2018 at 22:52
  • Worth noting, there's nothing in the HTTP spec that forbids a body with a GET method, and in fact it's commonly used with some APIs, see: elastic.co/guide/en/elasticsearch/reference/current/… Commented Aug 6, 2020 at 18:48
  • While that may be true, this question is regarding API Gateway which does not allow it.
    – Dave S
    Commented Aug 7, 2020 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.