AWS API Gateway - lambda integration missing authorization header

Question

My API includes various GET, POST and DELETE endpoints set up in AWS API Gateway. Each endpoint is integrated with Lambda and calls its own Lambda python function.

I have set up authorization manually (not through AWS authorizers): I call the endpoints with a bearer token in the "Authorization" header, and the Lambda functions access event["headers"]["Authorization"] to obtain the token. This works fine for POST and DELETE endpoints. However, when calling GET endpoints, the "Authorization" header is missing from the event["headers"] object (only other headers added by AWS are present).

I have tried calling the GET endpoints through various methods. Also worth mentioning that this is not a case sensitivity issue - the token I provide is not found anywhere in the events object.

All my endpoints are configured like this in API Gateway:

Method Request:

Integration Request:

Does API Gateway or Lambda remove the "Authorization" automatically for GET calls?

Yes, I'm using CloudFront. I definitely should have mentioned that. My "behavior" is not set up with any "Response headers policy" at the moment. — pauliner
– pauliner, Commented Jan 31, 2023 at 16:10
CloudFront strips away headers for GET request unless you specify to forward them. It's under the Cache key and origin requests under Behavior option. You should create a custom cache policy to include the Authorization header. — Amir Asyraf
– Amir Asyraf, Commented Feb 1, 2023 at 3:10

Amir Asyraf · Accepted Answer · 2023-02-01 03:26:48Z

1

As you've mentioned that you use CloudFront in front of your API gateway, I believe I know what the problem is.

By default, CloudFront strips away params and headers from the request before forwarding it to origin. You need to modify your cache behaviour to forward the Authorization header to origin.

Go to your CloudFront distribution, and edit the behaviour for that distribution. Then, scroll down to 'Cache key and origin requests'.

You need to create a new cache policy that forwards the Authorization header, like so:

answered Feb 1, 2023 at 3:26

Amir Asyraf

6781 gold badge9 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

pauliner Over a year ago

Thank you! That worked, although I am still confused about why this was necessary for GET requests and not POST, PUT and DELETE requests.

Amir Asyraf Over a year ago

Because only GET and HEAD requests are cached

Collectives™ on Stack Overflow

AWS API Gateway - lambda integration missing authorization header

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related