Fix openapi authorization header for type token#7851
Conversation
whummer
left a comment
There was a problem hiding this comment.
+1 on the refined logic based on authorizer_type 👍 - just not sure if we're selecting the default identitySource header name properly here..
| if identity_source := aws_apigateway_authorizer.get("identitySource"): | ||
| if authorizer_type == "TOKEN": | ||
| header_name = security_config.get("name") | ||
| authorizer["identitySource"] = f"method.request.header.{header_name}" |
There was a problem hiding this comment.
Not sure if we can rely on the name of the security config to be the header name of the identitySource here? I understand that this is part of the examples in the AWS docs , but seems to me that the name can be arbitrarily chosen (and hence may not necessarily map to the header name).
Maybe the default identitySource should rather be "method.request.header.Authorization" here? As usual, a parity/snapshot test would help us get ultimate clarity on this question. 🤷
There was a problem hiding this comment.
not sure I agree here, so the name is a specific field of the authorizer extension, and for the type TOKEN must be a header.
Maybe the default identitySource should rather be "method.request.header.Authorization" here? As usual, a parity/snapshot test would help us get ultimate clarity on this question.
that's precisely one of the issues, we had always default to that and must use whatever the user defines - https://github.com/localstack/localstack-ext/blob/289bfe82cfa11f9b79412938e8c647c69aa2375c/localstack_ext/services/apigateway/authorizers.py#L387-L389
There was a problem hiding this comment.
Actually, I think you're right - thanks for clarifying! Looking more closely at this line in the docs - looks like the name of the authorizer is indeed the name of the header 👍 :
"name" : "Authorization", // The name of the header containing the authorization token.
Happy to merge as-is. As usual with API Gateway: the docs can sometimes be misleading/outdated/unclear - so let's try to complement this with a snapshot test in an upcoming PR!
small fix to handle openapi
x-amazon-apigateway-authorizerextension for authorizer typeTOKEN.https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-authorizer.html