Signed Cookie Auth in AWS Lambda

index.js

"use strict";

const AWS = require('aws-sdk');
const serverless = require('serverless-http');
const Koa = require('koa');
const Router = require('koa-router');
const crypto = require('crypto');
const bodyParser = require('koa-bodyparser');
const fs = require("fs");
const app = new Koa();
const router = new Router();
const s3 = new AWS.S3();


app.proxy = true;
app.keys = ['mysecretkey'];
app.use(router.routes());
app.use(bodyParser());

router.get("/login", async (ctx, next) => {
    let cookies = ctx.cookies.get("AuthToken", { signed: true });
    if (cookies) {
        return ctx.redirect("/dev/index"); //cookie exits, go to homepage
    }
    //show login form
    let url = ctx.request.url.replace(/^(.*?)\?.*$/, '$1'); // strip off any parameters
    let loginForm = fs.readFileSync('./login.html', 'utf8');
    ctx.body = loginForm;
});

router.post("/login", bodyParser(), async (ctx, next) => {
    //accept login form request
    if (validateCredentials(ctx.request.body)) {
        console.log('User authenticated ... ');
        ctx.cookies.set('AuthToken', crypto.randomBytes(64).toString('hex'), {
            signed: true,
            secure: false,
            httpOnly: true,
            // 1 hour
            expires: new Date(3600000 + Date.now())
        });
        return ctx.redirect("/dev/index"); //login was successful
    }
    else {
        console.log('User rejected ... ');
        return ctx.status = 401;
    }
});

const validateCredentials = (body) => {
    if (body.userid === 'admin' && body.password === 'password') {
        return true;
    }
    return false;
}


app.use(async ctx => {
    try {
        let content = fs.readFileSync('./default.html', 'utf-8'); //this is the default content to show
        let requestType = ctx.request.method;
        let url = ctx.request.url.replace(/^(.*?)\?.*$/, '$1'); // strip off any parameters

        //check for signed cookie here
        let cookies = ctx.cookies.get("AuthToken", { signed: true });
        //TO-DO: do logic to parse and check token expiry

        if (!cookies) {
            return ctx.redirect("/dev/login"); //there is no cookie, redirect to login screen
        }

        //this stays as it is
        switch (url) {
            default: {
                ctx.body = content;
                break;
            }
        }
        console.log('sending request baaack');
    }
    catch (err) {
        console.error(err);
        ctx.throw(404, 'Not found');
    }
});

module.exports.handler = serverless(app, {
    binary: ['image/png']
});

Auth with Koa and Serverless-HTTP with AWS Lambda with signed cookies. Not perfect, but a start.