-
-
Save lmakarov/e5984ec16a76548ff2b278c06027f1a4 to your computer and use it in GitHub Desktop.
| 'use strict'; | |
| exports.handler = (event, context, callback) => { | |
| // Get request and request headers | |
| const request = event.Records[0].cf.request; | |
| const headers = request.headers; | |
| // Configure authentication | |
| const authUser = 'user'; | |
| const authPass = 'pass'; | |
| // Construct the Basic Auth string | |
| const authString = 'Basic ' + new Buffer(authUser + ':' + authPass).toString('base64'); | |
| // Require Basic authentication | |
| if (typeof headers.authorization == 'undefined' || headers.authorization[0].value != authString) { | |
| const body = 'Unauthorized'; | |
| const response = { | |
| status: '401', | |
| statusDescription: 'Unauthorized', | |
| body: body, | |
| headers: { | |
| 'www-authenticate': [{key: 'WWW-Authenticate', value:'Basic'}] | |
| }, | |
| }; | |
| callback(null, response); | |
| } | |
| // Continue request processing if authentication passed | |
| callback(null, request); | |
| }; |
You should return the callback or wrap the second call to it into a else case.
Hi!
Inspired from this I made my own version which is using a shared cookie secret to allow application to use Authorization header for JWT Bearer tokens. See webscale-oy/aws-cloudfront-basic-auth for Cloudformation templates and documentation.
Super helpful. Thank you very much!
With serverless configuration: https://tracklify.com/blog/simple-basic-auth-in-aws-cloudfront-with-serverless
Can we pick the credentials from secret manager? can anyone help with the code?
Can we pick the credentials from secret manager? can anyone help with the code?
Do anyone get a problem that in phone (ios) it just popup password panel serveral times when loading the website?
Similar problem here.
It seems the Authorization header is no longer read by Lambda or some other part of the chain?
I replaced line 17 with:
const body = 'Unauthorized, headers are ' + JSON.stringify(headers);Test case (with some sensitive data replaced by [...]):
$ curl --user xxx:yyy https://my_endpoint
[...]
> GET / HTTP/2
> Host: [...]
> Authorization: Basic eHh4Onl5eQ==
< HTTP/2 401
< content-length: 341
< server: CloudFront
< date: Mon, 28 Sep 2020 16:40:50 GMT
* Authentication problem. Ignoring this.
< www-authenticate: Basic
[...]
Unauthorized, headers is {"host":[{"key":"Host","value":"[...]"}],"x-forwarded-for":[{"key":"X-Forwarded-For","value":"[...]"}],"user-agent":[{"key":"User-Agent","value":"Amazon CloudFront"}],"via":[{"key":"Via","value":"[...]"}]}* Closing connection 0
The headers variable has no key authorization.
@rkz - make sure that your trigger CloudFront Event is Viewer Request and not Origin Request. The auth headers are stripped out of Origin.
@nachmore that was it :) Thank you
Line 23 is broken - the realm parameter is mandatory! This is documented in RFC7617 section 2 and I found out because Python's urllib's AuthHandler classes do not recognise the header without realm=.
This is now also possible, cheaper and faster with the newly launched CloudFront Functions (https://gist.github.com/jeroenvollenbrock/94edbbc62adc986d6d6a9a3076e66f5b)
@rkz - make sure that your trigger CloudFront Event is
Viewer Requestand notOrigin Request. The auth headers are stripped out ofOrigin.
I added the 'Authorization' header to the cache key and it now comes through to the 'Origin Request'. My issue is that I need both this header as well as the origin domain for my lambda, and I can't determine the domain from the 'Viewer Request' . Wish this stuff was documented better.
Can we pick the credentials from secret manager? can anyone help with the code?
Tried adding aws-cdk to lamda@edge function that is attached to viewer request but size limitation of 1MB for Viewer Request is blocking me. Because with the inclusion of aws-cdk package, the zip file size is increasing more than 4 MB (even with ssm package). Any other workaround for this problem ??
It looks like Amazon has no official documentation on how to do this, Authorizers are only documented to use token auth with APIs, not basic auth.
What is a better alternative to securing a dev or staging site from prying eyes such as dev.mysite.com Firewall with IP restrictions can be unreliable with changing IPs and hinder developer productivity?
@iamwalker In CloudFront, under "Origin Settings", you can set the Origin Path. For example, I'm running an S3 bucket with dev, stage and prod folders. I have one CloudFront distribution for each one.