completecoding / serverless-auto-swagger

80 stars 48 forks source link

How to set WWW-Authenticate header when using lambdaAuthorizer #114

Closed kevinvarley closed 1 year ago

kevinvarley commented 1 year ago

When using a custom lambdaAuthorizer with this plugin, is there a way to set the API Gateway Response Header WWW-Authenticate = 'Basic' so that a web browser would prompt to enter a username and password which could then be forwarded to the authorizer?

kevinvarley commented 1 year ago

Ended up using a type: request authorizer instead and locked it down by IP address.

If you set ALL responses from the API Gateway have the WWW-Authenticate header on them, then this works.

If you set only SOME of the responses from the API Gateway to have the header on, you run into the issue where by the client accesses the docs URL and because they are not providing any value in the Authorization header, then it results in the Authorizer never being called so we can't set the header on the response.

I ended up moving away from the idea of using HTTP Basic Auth and instead created a type: request Authorizer and did an IP whitelist instead.