Comments (4)
Hi David-
If you want to properly secure an API Gateway-hosted API, but don't want your customers to know that it is hosted by AWS or using API Gateway, then I would avoid the IAM-signing option as SigV4 signing is a standard developed by AWS and could be traced back to AWS. In this case, you'd likely want to use a custom authorizer via Lambda function, in which case Cognito is completely optional and you can use the identity provider of your choice (including Facebook, Google, or any provider that supports bearer tokens).
Additionally, I would setup a custom domain name for your API Gateway deployment so that your customers only reference "api.yourdomain.com" when connecting without needing to know anything else or seeing the long dynamically generated unique AWS URL of the API Gateway deployment.
If you wanted to still do throttling of users, it'd be best to use API Keys and usage plans, in conjunction with your own Authorization header for calls (which is used by the custom authorizer to generate an effective IAM policy for the use, though the user does not see this or know about it).
Please let us know if you have further questions. I hope this clarifies.
Justin
from aws-serverless-auth-reference-app.
Hi, Justin
Thanks very much for your information, great helpful!
Yes, I am planning to use API keys, usage plan, with API-Gateway in our domain, custom authorizer.
While one question about the work flow from developers as API consumer, for example, with Cognito User Pool as provider(preferred way, or probably it'll be the only one provider), and how to upload files to S3(better to bypass api gateway if possible)
- 1.register the app(API consume app), generate API keys with Cognito via our domain API,
- 2.send the credentials along with API key to every AWS API Gateway,
- 3.AWS custom authorizer
a.confirm by calling Cognito User Pool with provided credentials, keys
b.handle it accordingly.
Is the above flow correct?
Sorry, this is a little bit silly question, but I don't have experience before so it'd be great if could get best practice from you.
Thanks very much again
David
from aws-serverless-auth-reference-app.
For uploading images or other binary content to S3, you have several options:
As you mentioned, you can use API Gateway with Lambda to upload binary content, though you'd have to ensure additional content types are included beyond the default, then could use Lambda to parse the base 64 encoded image and upload to S3.
However, the preferred way, in my opinion, is to let the user write to S3 directly using the AWS SDK to enable multi-part uploads. If you already have the AWS SDK integrated in your project, either the browser JS SDK or Android/iOS SDK will work, then you can use temporary IAM role credentials to initialize it via an AWS access key, secret access key, and session token. This is exactly how our sample project uploads an image to S3 from the "account" page in the app. The biggest benefit of this approach is that you can leverage the built-in S3 multi-part upload functionality and other enhancements AWS has already developed in the SDK.
The preferred way to get the temporary IAM credentials for a user is to first have them authenticate with whichever identity provider they have an account with (Cognito User Pools, Google, Facebook, SAML-based, etc.) then use the returned token with Cognito Federated Identities to assume a Cognito identity IAM role. Hence, this is an option whether or not you're using Cognito User Pools and does not require a custom authorizer for this particular use case.
Hope this helps.
Justin
from aws-serverless-auth-reference-app.
Thanks very much, Justin
I was thinking to hide internal info like what service we use from 3rd part developers, but seems it's not best practice, and not easy to achieve.
Thanks again
from aws-serverless-auth-reference-app.
Related Issues (20)
- Side menu version HOT 1
- CAN'T CONVERT IONIC TO PWA..!!
- regenerating sdk causes issues HOT 3
- How can you add a second IdP without losing roles logic?
- "Bookings" failed on showing booked resource list-Run in a web browser HOT 1
- Store Login data and auto login
- Tighten Up Lambda Execution Role Policy By Using Policy Variable (identity ID or Subscriber ID) Fine-Grained Access to DynamoDB HOT 5
- Can not connect using putty and ec2-user HOT 6
- Is the user information in account-management.service.ts secure?
- AWSCognito is not defined in account-management.service.ts
- lambda wrapper functions break any Promise returns
- api create_sdk command fails HOT 2
- Token refresh
- Cannot run gulp deploy HOT 2
- Generated Java API SDK has lots of Syntax errors HOT 2
- Could you provide some sample Java code for Cognito UserPool Authorizer client
- Account Image is not persisted
- How can i get my temporary credentials for my federated Id token ? HOT 1
- gulp deploy fails on lambda creation - repo needs to be updated for supported nodejs version HOT 3
- Demo to migrate to AppSync and GraphQL?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-serverless-auth-reference-app.