Hey everyone! I am using AWS Api Gateway and I would like to use the authorizer function described h...

jonasalexanderson

01/21/2023, 1:34 PM

Hey everyone! I am using AWS Api Gateway and I would like to use the authorizer function described here: https://supertokens.com/docs/thirdpartyemailpassword/serverless/with-aws-lambda/authorizer I do not want to hit my Supertokens server with every request though. Therefore I was wondering what endpoint does

await Session.getSession()

hit and is it possible to cache that response with AWS Cloudfront that sits in front of my Supertokens server?

rp_st

01/21/2023, 1:35 PM

Hey @jonasalexanderson

rp_st

01/21/2023, 1:35 PM

The getSession function is stateless.

rp_st

01/21/2023, 1:35 PM

So the verification is super fast anyway

jonasalexanderson

01/21/2023, 1:37 PM

But is has to hit my Supertokens server to request encrytion keys somehow

jonasalexanderson

01/21/2023, 1:38 PM

I want to deploy my server only in one AWS region and have the keys distribute with Cloudfront to their edge locations

rp_st

01/21/2023, 1:38 PM

Oh right. Yea. That happens every time the serverless function starts. Once. So if the authoriser is kept “hot” it won’t make requests again and again.

jonasalexanderson

01/21/2023, 1:39 PM

What do you mean by "once"? I expect that the keys are rotated eventually, right?

rp_st

01/21/2023, 1:40 PM

Yes. I think once every 24 hours. So when the keys are rotated, the getSession queries once again. But relatively speaking, this is a rare operation

rp_st

01/21/2023, 1:40 PM

So 99% of the getSession won’t make a network call anyway as long as the authoriser is kept hot. Which I think AWS does on its own.

jonasalexanderson

01/21/2023, 1:42 PM

I do not know about that. If you have a cold lambda function that has to make a trip around the world to get keys, you do have some noticable delay in response times

jonasalexanderson

01/21/2023, 1:43 PM

I looked at the supertokens-node repo. The getSession function eventually makes a call to

/recipce/handshake

. Is it safe to tell Cloudfront to cache that response or does its response depend on the payload that was send to it?

rp_st

01/21/2023, 1:43 PM

You shouldn’t cache that response

rp_st

01/21/2023, 1:43 PM

If you want to take control of the keys, I suggest that you switch to using the JWT based auth. In that, you can even hard code the public keys in the lambda itself. But then you won’t have key rotation.

jonasalexanderson

01/21/2023, 1:45 PM

Thank you. I could implement Method 1 (https://supertokens.com/docs/session/common-customizations/sessions/with-jwt/jwt-verification), because the jwks.json end point it a GET end point and looks like I could cache it

rp_st

01/21/2023, 1:45 PM

Yea. You could. The downside here is that you don’t have key rotation. So slightly less secure.

rp_st

01/21/2023, 1:45 PM

But we are working on a change where we will provide key rotation for JWT based auth as well. Coming sometime next month.

jonasalexanderson

01/21/2023, 1:47 PM

That is awesome. How would that work? Would you add another item to the

keys

array and start signing all new tokens with the new key and remove older keys from the array eventually?

rp_st

01/21/2023, 1:47 PM

Yes

jonasalexanderson

01/21/2023, 1:47 PM

👍

jonasalexanderson

01/21/2023, 1:48 PM

Thank you for your help. I know what to do now

cbwhite920

03/20/2023, 11:21 PM

Hey @jonasalexanderson , did you get this working with a jwt authorizer? I tried going this route and am now getting CORS issues from the OPTIONS calls to my auth endpoints, and have a feeling it might be due to my API Gateway setup somehow so wondering if you figured it out?

jonasalexanderson

03/23/2023, 2:14 PM

Hey @cbwhite920 , I did not implement it yet. What endpoint throws CORS errors for you?

cbwhite920

03/23/2023, 2:20 PM

Oh ok no worries, I found out it was because with an Http Api Gateway if you set up CORS settings on the gateway it overwrites the CORS headers so that was causing trouble

cbwhite920

03/23/2023, 2:22 PM

Found out the solution is to not set up anything for CORS on the gateway, allow the lambda itself to handle CORS headers explicitly, then also expose the OPTIONS method on your endpoint explicitly and I had to use a Lamba integration for that which basically just returns success

cbwhite920

03/23/2023, 2:24 PM

Then from the frontend I had to extract the jwt from the access token payload and set that in my Authorization header for my jwt authorizer to pass, and then my GET call to my api endpoint was getting hit

cbwhite920

03/23/2023, 2:25 PM

But, now I’m running into an issue where the lambda behind that GET call returns successfully with expected data, but the gateway is giving back a 500 server error with no additional info to troubleshoot with, so think I’m going to have to go back and try the Rest Api Gateway approach

cbwhite920

03/23/2023, 2:42 PM

sorry for the book lol. To answer your actual question though, the session refresh endpoint was throwing CORS errors, but it was because at first the Authorization header wasn't coming through, then it was because I was passing the supertokens access token payload and not the contained jwt

Previous Next

SuperTokens.com

SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).