Serverless-offline: Faking a Cognito user pool authorizer
I would like to be able to emulate a Cognito user pool authorizer with serverless-offline. The primary use case would be to test lambdas that are looking for a "current user" id/username via requestContext.authorizer.claims.sub and requestContext.authorizer.claims.cognito:username.
Looking at createLambdaProxyContext.js it seems it would be possible to look for a "claims" configuration via request headers/environment variables/serverless.yml and if found, replace the current requestContext.authorizer.principalId section with a requestContext.authorizer.claims section.
I would be up for implementing this myself if this approach is correct. Any thoughts or pointers?
bwinant
All 11 comments
Those don't address your issue ? https://github.com/dherault/serverless-offline/issues?utf8=%E2%9C%93&q=is%3Aissue%20cognito
dherault
on 6 Jul 2017
I don't think so. What I would like to do is inject requestContext.authorizer.claims with some test values into the lambda context just like you can inject requestContext.authorizer.principalId with a value.
My problem is I have lambdas that are tied to API Gateway endpoints that are secured with a Cognito user pool authorizer and those lambdas retrieve the username for the current user via requestContext.authorizer.claims. Since createLambdaProxyContext.js doesn't populate that my lambdas are generating JS errors since the property doesn't even exist on the object
Hope that makes sense.
bwinant
on 6 Jul 2017
I'm also looking for the exact same solution. I'm using requestContext.authorizer.claims.sub as a value for a key on a user doc in mongo and I'd like to be able to test it out.
Loag
on 20 Jul 2017
This might not be what you're looking for but you could use the LambdaTester library and do something like this
it('get account (get)', (done) => {
LambdaTester('ROUTE_HERE')
.event({requestContext: {authorizer: { claims: { sub: '1'} } } })
.expectResult((result) => {
expect(result.statusCode === 200);
})
.verify(done);
});
Loag
on 20 Jul 2017
I have a simple code to add to createLambdaProxyContext.js to populate claims by decoding JWT token from the Authorization header if present. That way we can test our lambda access control logic that depends on claims in the token (like custom roles, etc). I will create a pull request shortly.
ppasmanik
on 23 Aug 2017
@ppasmanik if you want any help testing your pull request I would be happy to help
bwinant
on 29 Aug 2017
Sure. I have a good test coverage in the pull request, but you are welcome to do any kind of integration tests.
From: Brian Winant notifications@github.com
Sent: Monday, August 28, 2017 7:37:46 PM
To: dherault/serverless-offline
Cc: Pasmanik, Paul; Mention
Subject: Re: [dherault/serverless-offline] Faking a Cognito user pool authorizer (#264)
@ppasmanikhttps://github.com/ppasmanik if you want any help testing your pull request I would be happy to help
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/dherault/serverless-offline/issues/264#issuecomment-325512430, or mute the threadhttps://github.com/notifications/unsubscribe-auth/ADXv87A11xFEqSzEamYT8FemVniAS0feks5sc09KgaJpZM4OPZu2.
The information contained in this electronic transmission is intended only for the use of the recipient and may be confidential and privileged. Unauthorized use, disclosure, or reproduction is strictly prohibited and may be unlawful. If you have received this electronic transmission in error, please notify the sender immediately. In order to make sure you receive our emails with the latest news on Dante, please add [email protected] to your contact list.
ppasmanik
on 29 Aug 2017
This will be great for us once it's available!
g-combs-hobsons
on 8 Sep 2017
Is it available now?
sid88in
on 10 Oct 2017
it should be
From: Siddharth Gupta notifications@github.com
Sent: Tuesday, October 10, 2017 11:49:23 AM
To: dherault/serverless-offline
Cc: Pasmanik, Paul; Mention
Subject: Re: [dherault/serverless-offline] Faking a Cognito user pool authorizer (#264)
Is it available now?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/dherault/serverless-offline/issues/264#issuecomment-335518388, or mute the threadhttps://github.com/notifications/unsubscribe-auth/ADXv89LYn6FforqZV3MpaxaZjNrMZTplks5sq5IDgaJpZM4OPZu2.
The information contained in this electronic transmission is intended only for the use of the recipient and may be confidential and privileged. Unauthorized use, disclosure, or reproduction is strictly prohibited and may be unlawful. If you have received this electronic transmission in error, please notify the sender immediately. In order to make sure you receive our emails with the latest news on Dante, please add [email protected] to your contact list.
ppasmanik
on 12 Oct 2017
Yes I can use --no-auth :) it works! thanks
sid88in
on 12 Oct 2017
Related issues
ktwbc
·
4Comments
adambiggs
·
4Comments
JimLynchCodes
·
4Comments
conradoramalho
·
3Comments
aldofunes
·
3Comments
Most helpful comment
I have a simple code to add to createLambdaProxyContext.js to populate claims by decoding JWT token from the Authorization header if present. That way we can test our lambda access control logic that depends on claims in the token (like custom roles, etc). I will create a pull request shortly.