Hey everyone! I am using AWS Api Gateway and I wou...
# support-questions-legacyj
jonasalexanderson
01/21/2023, 1:34 PMHey everyone! I am using AWS Api Gateway and I would like to use the authorizer function described here: https://supertokens.com/docs/thirdpartyemailpassword/serverless/with-aws-lambda/authorizer
I do not want to hit my Supertokens server with every request though. Therefore I was wondering what endpoint does
await Session.getSession()r
rp_st
01/21/2023, 1:35 PMHey @jonasalexanderson
rp_st
01/21/2023, 1:35 PMThe getSession function is stateless.
rp_st
01/21/2023, 1:35 PMSo the verification is super fast anyway
j
jonasalexanderson
01/21/2023, 1:37 PMBut is has to hit my Supertokens server to request encrytion keys somehow
jonasalexanderson
01/21/2023, 1:38 PMI want to deploy my server only in one AWS region and have the keys distribute with Cloudfront to their edge locations
r
rp_st
01/21/2023, 1:38 PMOh right. Yea. That happens every time the serverless function starts. Once. So if the authoriser is kept “hot” it won’t make requests again and again.
j
jonasalexanderson
01/21/2023, 1:39 PMWhat do you mean by "once"? I expect that the keys are rotated eventually, right?
r
rp_st
01/21/2023, 1:40 PMYes. I think once every 24 hours. So when the keys are rotated, the getSession queries once again. But relatively speaking, this is a rare operation
rp_st
01/21/2023, 1:40 PMSo 99% of the getSession won’t make a network call anyway as long as the authoriser is kept hot. Which I think AWS does on its own.
j
jonasalexanderson
01/21/2023, 1:42 PMI do not know about that. If you have a cold lambda function that has to make a trip around the world to get keys, you do have some noticable delay in response times
jonasalexanderson
01/21/2023, 1:43 PMI looked at the supertokens-node repo. The getSession function eventually makes a call to
/recipce/handshaker
rp_st
01/21/2023, 1:43 PMYou shouldn’t cache that response
rp_st
01/21/2023, 1:43 PMIf you want to take control of the keys, I suggest that you switch to using the JWT based auth. In that, you can even hard code the public keys in the lambda itself. But then you won’t have key rotation.
j
jonasalexanderson
01/21/2023, 1:45 PMThank you. I could implement Method 1 (https://supertokens.com/docs/session/common-customizations/sessions/with-jwt/jwt-verification), because the jwks.json end point it a GET end point and looks like I could cache it
r
rp_st
01/21/2023, 1:45 PMYea. You could. The downside here is that you don’t have key rotation. So slightly less secure.
rp_st
01/21/2023, 1:45 PMBut we are working on a change where we will provide key rotation for JWT based auth as well. Coming sometime next month.
j
jonasalexanderson
01/21/2023, 1:47 PMThat is awesome. How would that work? Would you add another item to the
keysr
rp_st
01/21/2023, 1:47 PMYes
j
jonasalexanderson
01/21/2023, 1:47 PM👍
jonasalexanderson
01/21/2023, 1:48 PMThank you for your help. I know what to do now
c
cbwhite920
03/20/2023, 11:21 PMHey @jonasalexanderson , did you get this working with a jwt authorizer? I tried going this route and am now getting CORS issues from the OPTIONS calls to my auth endpoints, and have a feeling it might be due to my API Gateway setup somehow so wondering if you figured it out?
j
jonasalexanderson
03/23/2023, 2:14 PMHey @cbwhite920 , I did not implement it yet. What endpoint throws CORS errors for you?
c
cbwhite920
03/23/2023, 2:20 PMOh ok no worries, I found out it was because with an Http Api Gateway if you set up CORS settings on the gateway it overwrites the CORS headers so that was causing trouble
cbwhite920
03/23/2023, 2:22 PMFound out the solution is to not set up anything for CORS on the gateway, allow the lambda itself to handle CORS headers explicitly, then also expose the OPTIONS method on your endpoint explicitly and I had to use a Lamba integration for that which basically just returns success
cbwhite920
03/23/2023, 2:24 PMThen from the frontend I had to extract the jwt from the access token payload and set that in my Authorization header for my jwt authorizer to pass, and then my GET call to my api endpoint was getting hit
cbwhite920
03/23/2023, 2:25 PMBut, now I’m running into an issue where the lambda behind that GET call returns successfully with expected data, but the gateway is giving back a 500 server error with no additional info to troubleshoot with, so think I’m going to have to go back and try the Rest Api Gateway approach
cbwhite920
03/23/2023, 2:42 PMsorry for the book lol. To answer your actual question though, the session refresh endpoint was throwing CORS errors, but it was because at first the Authorization header wasn't coming through, then it was because I was passing the supertokens access token payload and not the contained jwt