'use strict'; | |
exports.handler = (event, context, callback) => { | |
// Get request and request headers | |
const request = event.Records[0].cf.request; | |
const headers = request.headers; | |
// Configure authentication | |
const authUser = 'user'; | |
const authPass = 'pass'; | |
// Construct the Basic Auth string | |
const authString = 'Basic ' + new Buffer(authUser + ':' + authPass).toString('base64'); | |
// Require Basic authentication | |
if (typeof headers.authorization == 'undefined' || headers.authorization[0].value != authString) { | |
const body = 'Unauthorized'; | |
const response = { | |
status: '401', | |
statusDescription: 'Unauthorized', | |
body: body, | |
headers: { | |
'www-authenticate': [{key: 'WWW-Authenticate', value:'Basic'}] | |
}, | |
}; | |
callback(null, response); | |
} | |
// Continue request processing if authentication passed | |
callback(null, request); | |
}; |
This comment has been minimized.
This comment has been minimized.
Thanks Leonid for sharing this. Lines 8 to 13 if moved before the function (before line 2) it will be parsed just once and cached in memory for next executions. |
This comment has been minimized.
This comment has been minimized.
This should be in the official AWS docs. Extremely useful; thanks for sharing! |
This comment has been minimized.
This comment has been minimized.
Agreed ! There is little documentation on Lambda Edge. Thank you for sharing the code |
This comment has been minimized.
This comment has been minimized.
Imakarov did you finish full doc on how to setup this? I am having hard time implementing this getting errors when assigning role to lambda. Which role should i use and which policies i have to add that role? |
This comment has been minimized.
This comment has been minimized.
I had the same problem. Your Lambda has to be in N. Virginia (althought that might have changed). Find the role you assigned to the Lambda Function, and edit the policy "Trust Relationship" to something like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"edgelambda.amazonaws.com",
"lambda.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
}
This worked for me. AWS Documentation does not explain that very well. Good Luck ! |
This comment has been minimized.
This comment has been minimized.
Hi, I have configured everything. But i still can't access file in my s3 bucket. I am trying to access a file in this s3 bucket. it's only listing the object. I wanted it be able to download or read. This XML file does not appear to have any style information associated with it. The document tree is shown below. |
This comment has been minimized.
This comment has been minimized.
Is there a way to set this up on specific directories in the s3 bucket? i.e. domain.com allowed, domain.com/dir triggers auth |
This comment has been minimized.
This comment has been minimized.
@iamwalker In CloudFront, under "Origin Settings", you can set the Origin Path. For example, I'm running an S3 bucket with dev, stage and prod folders. I have one CloudFront distribution for each one. |
This comment has been minimized.
This comment has been minimized.
You should return the callback or wrap the second call to it into a else case. |
This comment has been minimized.
This comment has been minimized.
Hi! Inspired from this I made my own version which is using a shared cookie secret to allow application to use Authorization header for JWT Bearer tokens. See webscale-oy/aws-cloudfront-basic-auth for Cloudformation templates and documentation. |
This comment has been minimized.
This comment has been minimized.
Super helpful. Thank you very much! |
This comment has been minimized.
This comment has been minimized.
With serverless configuration: https://tracklify.com/blog/simple-basic-auth-in-aws-cloudfront-with-serverless |
This comment has been minimized.
This comment has been minimized.
Can we pick the credentials from secret manager? can anyone help with the code? |
This comment has been minimized.
This comment has been minimized.
|
This comment has been minimized.
This comment has been minimized.
Do anyone get a problem that in phone (ios) it just popup password panel serveral times when loading the website? |
This comment has been minimized.
This comment has been minimized.
Similar problem here. It seems the Authorization header is no longer read by Lambda or some other part of the chain? I replaced line 17 with: const body = 'Unauthorized, headers are ' + JSON.stringify(headers); Test case (with some sensitive data replaced by
The |
This comment has been minimized.
This comment has been minimized.
@rkz - make sure that your trigger CloudFront Event is |
This comment has been minimized.
This comment has been minimized.
@nachmore that was it :) Thank you |
This comment has been minimized.
This comment has been minimized.
Line 23 is broken - the realm parameter is mandatory! This is documented in RFC7617 section 2 and I found out because Python's urllib's AuthHandler classes do not recognise the header without |
This comment has been minimized.
See my article on Medium for details.