Package: cdk-recaptcha-authorizer
Google reCAPTCHA API Gateway REST API authorizerThis construct provides an API Gateway REST API authorizer that uses Google's reCAPTCHA service to detect abusive
traffic and allow or deny access to the API methods.It currently only supports v3 of the reCAPTCHA service.InstallationTypeScript / JavaScriptnpm install cdk-recaptcha-authorizeroryarn add cdk-recaptcha-authorizerPythonpip install cdk-recaptcha-authorizerJava<dependency><groupId>com.engineal.cdk</groupId><artifactId>cdk-recaptcha-authorizer</artifactId></dependency>C# / .Netdotnet add package EngineAL.CDK.RecaptchaAuthorizerUsageSeehttps://developers.google.com/recaptcha/docs/v3for how to integrate reCAPTCHA in your client code. When
your client code executes the reCAPTCHA client, the returned token from the Google reCAPTCHA client library
should be included in the API Gateway request in theX-reCAPTCHA-Tokenheader.TheRecaptchaAuthorizercan be used similarly to theTokenAuthorizerandRequestAuthorizerthat are
provided by theaws-cdk-lib/aws-apigatewaypackage. It accepts 3 properties:scoreThreshold(default: 0.5) is the threshold below which requests will be denied.allowedActionsis a list of allowed actions. When your frontend executes the reCAPTCHA client, it provides
an action name. The reCAPTCHA authorizer will verify this action is allowed and deny a request if the action
is not in this list.reCaptchaSecretKeyis aSecretKeythat provides the reCAPTCHA secret key to the reCAPTCHA authorizer.
SeeSecret Key.The following code attaches the reCAPTCHA authorizer to the 'GET' method of the root resource.constauthorizer=newRecaptchaAuthorizer(this,'reCaptchaAuthorizer',{allowedActions:['my-action'],reCaptchaSecretKey:SecretKey.fromPlainText('my-secret-key')});api.root.addMethod('GET',newapigateway.MockIntegration(),{authorizer});Authorizers can also be passed via thedefaultMethodOptionsproperty within the RestApi construct or the
Method construct. Unless explicitly overridden, the specified defaults will be applied across all Methods
across the RestApi or across all Resources, depending on where the defaults were specified.Secret KeyThe lambda requires the secret key generated by the Google reCAPTCHA Admin Console. You can provide it using
3 methods: plain text, AWS SSM Parameter Store, or AWS Secrets Manager.Plain textSecretKey.fromPlainText('my-secret-key')SSM Parameter Storeconstparameter=ssm.StringParameter.fromStringParameterName(this,'TestParameter','test-secret-key');SecretKey.fromSsmParameter(parameter)Secrets ManagerconstsecretArn=`arn:${Stack.of(this).partition}:secretsmanager:${Stack.of(this).region}:${Stack.of(this).account}:secret:test-secret`;constsecret=secretsmanager.Secret.fromSecretArn(this,'TestSecret',secretArn);SecretKey.fromSecretsManager(secret)This also supports JSON secrets, and you can specify an optional field to use:.constsecretArn=`arn:${Stack.of(this).partition}:secretsmanager:${Stack.of(this).region}:${Stack.of(this).account}:secret:test-secret`;constsecret=secretsmanager.Secret.fromSecretArn(this,'TestSecret',secretArn);SecretKey.fromSecretsManager(secret,'my-secret-field')Useful commandsnpm run buildcompile the projectnpm run watchwatch for changes and compile as needednpm run packagegenerates libraries for all languagesnpm run testperform the jest unit testsLicenseCopyright 2023 Aaron LuciaLicensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License athttp://www.apache.org/licenses/LICENSE-2.0Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.