Package: cloudy-with-a-chance-of-meatballs.cdk-lambda-token-authorizer-jwt
CDK Lambda TokenAuthorizer JWTAdd a lambda function to your project which can be used as a apigateway token authorizerInstallTypeScriptnpminstall@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwtPythonpipinstallcloudy-with-a-chance-of-meatballs.cdk-lambda-token-authorizer-jwtUsageNotesJWT Token handling: The token verfification is done viahttps://github.com/auth0/node-jsonwebtoken, the jwks fetcher is usinghttps://github.com/auth0/node-jwks-rsa. The implementation per default verifies the token and if given the expiration.JWT Payload:Any verification of the token payload must be done over injecting a json schema for validation usinghttps://ajv.js.org/json-type-definition.html.Protocols:main/API.md#iauthorizeroptionsExample usage with Rest Apigatewayimport*ascdkfrom'aws-cdk-lib';import{Construct}from'constructs';import*asapigatewayfrom'aws-cdk-lib/aws-apigateway';import*aslambdafrom'aws-cdk-lib/aws-lambda';import{TokenAuthorizerJwtFunction}from'@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';exportclassHelloworldStackextendscdk.Stack{constructor(scope:Construct,id:string,props?:cdk.StackProps){super(scope,id,props);constapi=newapigateway.RestApi(this,'ApiName',{});consttokenAuthFunction=newTokenAuthorizerJwtFunction(this,'fnName',{tokenAuthorizerOptions:{verificationStrategy:{strategyName:'argument',secret:'mySecret-symmetric-or-asymmetric',},},});consttokenAuthorizer=newapigateway.TokenAuthorizer(this,'fnNameApiGwAuthorizer',{handler:tokenAuthFunction//usetheTokenAuthorizerJwtFunction});constdummyFn=newlambda.Function(this,'helloWorldFunction',{handler:'index.handler',code:lambda.Code.fromInline(`exports.handler=async(event)=>{console.log('event: ',event);return'{"statusCode": 200, "message": "DummyLambdaFunction"}'};`),runtime:lambda.Runtime.NODEJS_16_X,});constdummyLambdaIntegration=newapigateway.LambdaIntegration(dummyFn,{passthroughBehavior:apigateway.PassthroughBehavior.WHEN_NO_MATCH});constsomeMethod=api.root.addMethod("GET",dummyLambdaIntegration,{authorizer:tokenAuthorizer});}}Validationimport*ascdkfrom'aws-cdk-lib';import{TokenAuthorizerJwtFunction}from'@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';constapp=newcdk.App();conststack=newcdk.Stack(app,'MyStack');constmyValidation={properties:{iss:{enum:['my_trusted_iss']}}};newTokenAuthorizerJwtFunction(stack,'example-stack',{tokenAuthorizerOptions:{payloadValidationStrategy:{strategyName:'schema',schema:JSON.stringify(myValidation)},verificationStrategy:{strategyName:'argument',secret:'someSecret'}}});Using JWKSimport*ascdkfrom'aws-cdk-lib';import{TokenAuthorizerJwtFunction}from'@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';constapp=newcdk.App();conststack=newcdk.Stack(app,'MyStack');newTokenAuthorizerJwtFunction(stack,'example-stack',{tokenAuthorizerOptions:{verificationStrategy:{strategyName:'jwksFromUriByKid',uri:'uri',kid:'kid',}}});Using asymmetric algorithms, e.g. public keyimport*ascdkfrom'aws-cdk-lib';import{TokenAuthorizerJwtFunction}from'@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';constapp=newcdk.App();conststack=newcdk.Stack(app,'MyStack');constmyPublicKeyOneliner='-----BEGIN PUBLIC KEY---\nMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKuTfz7kpJHPrmcmgx4Xf4GMoM2kK4mh\nMpSOW3qu1zZA1wfMHV8PS0Kds0nXMB6mmHk/Ke1\Et68aEspQRIn1aLcCAwEAAQ==\n-----END PUBLIC KEY-----';newTokenAuthorizerJwtFunction(stack,'example-stack',{tokenAuthorizerOptions:{verificationStrategy:{strategyName:'argument',secret:myPublicKeyOneliner}}});Using symmetric algorithms, same key for sign and verify :warning:Attention:the key might be exposed during deploy, in the runtime etc.import*ascdkfrom'aws-cdk-lib';import{TokenAuthorizerJwtFunction}from'@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';constapp=newcdk.App();conststack=newcdk.Stack(app,'MyStack');constmySymmetricSecret='sharedSecret';newTokenAuthorizerJwtFunction(stack,'example-stack',{tokenAuthorizerOptions:{verificationStrategy:{strategyName:'argument',secret:mySymmetricSecret}}});🍻