Securing AWS HTTP APIs with JWT Authorizers

[john.brennan]

Hi @tim.martin! I’ve just run through Holly’s tutorial and combined it with mine and I’ve hopefully got an answer for you.

I believe that the reason that the app doesn’t automatically work has to do with CORS preflight requests. Axios sends an OPTIONS request to the API endpoint prior to the actual GET request to check that CORS is understood and the GET request will be allowed. There were a few changes I had to make to my HTTP API configuration to make preflight requests respond successfully and thus allow the API to be called from JavaScript applications:

1. In the switch statement inside the Lambda handler function, I added a case for OPTIONS requests that returns a 200 response with an empty body.
2. In addition to the GET and POST routes to wish-list-service in the HTTP API configuration, I added an OPTIONS route that connects to the Lambda integration, but isn’t connected to the JWT Authorizer:
   
   
3. I set the following configuration options in the CORS settings for the API:

• * to Access-Control-Allow-Origin
• authorization to Access-Control-Allow-Headers
• GET and POST to Access-Control-Allow-Methods
  
  

This tells the API to allow GET and POST requests from any origin and to allow those requests to include the authorization header.

One more note: I did also recreate the Express API from Holly’s post as an HTTP API, and setting up the Authorizer was a little more complex, as there were nested routes involved. I had to set up the JWT Authorizer on GET requests and allow OPTIONS requests to bypass the JWT Authorizer - here’s a screenshot of the Authorizers configuration in the API.

I hope that all makes sense and helps you get everything working!