AWS API Gateway custom Authorizer strange showing error

问题

Here is the context:

I set up a resource in the API gateway. /user/company
This resource have 2 methods. Get and POST.
I have configured a custom Authorizer for this resource.

The problem:

I can call the GET method by sending right authorization information and I get the results as expected.
I try to send a POST request and I get the following error:

{
  "message": "User is not authorized to access this resource"
}

If I wait for few minutes, then call the POST method, it will work.
If after calling the POST method and getting the results I call GET method, it will show the same error as mentioned above.

In addition, I have disabled cache for the authorizer.

What might have caused this issue?

回答1:

This could be fixed in two ways that are described in buggy's answer: https://forum.serverless.com/t/rest-api-with-custom-authorizer-how-are-you-dealing-with-authorization-and-policy-cache/3310

Short version:

Set TTL for customer authorizer to 0
Set custom authorizer policy resource as "*"

I've tried each solution and they both solved the issue with "User is not authorized to access this resource" for me.

回答2:

This error will occur if you use event.methodArn as a resource for generated policy and share an authorizer between different functions, because of how policy caching works. For provided token it caches a policy across an entire API, it will be the same cache entry for all methods and resources within the same API and stage (if they share the same authorizer).

For example, when making a request to GET /users, ARN will look something like this:

arn:aws:execute-api:us-1:abc:123/prod/GET/users

Next call to any endpoint with the same authentication token will use a cached policy, which was created on the first call to GET /users. The problem with that cached policy is that it's resource only allows a single particular resource arn: ... /prod/GET/users, any other resource will be rejected.

Depending on how much do you want to limit policy permissions, you can either mention every possible resource when creating a policy

{
  "principalId": "user",
  "policyDocument": {
    "Statement": [
      {
        "Action": "execute-api:Invoke",
        "Effect": "Allow",
        "Resource": [
          "arn:aws:execute-api:us-1:abc:123/prod/GET/v1/users",
          "arn:aws:execute-api:us-1:abc:123/prod/POST/v1/users",
          "arn:aws:execute-api:us-1:abc:123/prod/GET/v1/orders"
        ]
      }
    ],
    "Version": "2012-10-17"
  }
}

or use wildcards

"Resource": "arn:aws:execute-api:us-1:abc:123/prod/*/v?/*"

or even

"Resource": "*"

You can use policy variables for some advanced templates.

It is also possible to use a blacklist approach by allowing everything using wildcards and then denying specific resources in another policy statement.

Sources:

AWS forums: API Gateway issue about custom authorizers
AWS docs: IAM Policy resource field

回答3:

In the your custom policy build code use, the node js module aws-auth-policy The Nodejs part you can use ,

AuthPolicy.prototype.allowAllMethods = function () {
  addMethod.call(this, "allow", "*", "*", null);
}

In the code

const AuthPolicy = require('aws-auth-policy');
  const policy = new AuthPolicy(principalId, awsAccountId, apiOptions);
           // policy.allowMethod(method, resource);
            policy.allowAllMethods();
            const authResponse = policy.build();

回答4:

I fixed this by setting the AuthorizerResultTtlInSeconds to 0.

The reason for this is that I was using a shared authorizer. However the authorizer worked by reading the event context of the request and granting an IAM to then invoke a specific lambda.

Because the authorizer was shared it was caching the response which was an IAM for a specific lambda for the TTL of (in my case) 300 seconds.

Therefore, I could call one API one minute, then not the next.

Changing the value above to 0 fixed the issue.

回答5:

I was facing the same 'User is not authorized to access this resource' my mistake was I did not provided the OAuth Scopes in the Authorizer of my api gateway

来源：https://stackoverflow.com/questions/50331588/aws-api-gateway-custom-authorizer-strange-showing-error

标签

aws-api-gateway

custom-authentication