Closed kevinvarley closed 1 year ago
Ended up using a type: request
authorizer instead and locked it down by IP address.
If you set ALL responses from the API Gateway have the WWW-Authenticate header on them, then this works.
If you set only SOME of the responses from the API Gateway to have the header on, you run into the issue where by the client accesses the docs URL and because they are not providing any value in the Authorization
header, then it results in the Authorizer never being called so we can't set the header on the response.
I ended up moving away from the idea of using HTTP Basic Auth and instead created a type: request
Authorizer and did an IP whitelist instead.
When using a custom
lambdaAuthorizer
with this plugin, is there a way to set the API Gateway Response HeaderWWW-Authenticate
='Basic'
so that a web browser would prompt to enter a username and password which could then be forwarded to the authorizer?