search

jetbridge / cdk-nextjs

Deploy a NextJS application using AWS CDK
https://constructs.dev/packages/cdk-nextjs-standalone
Apache License 2.0
260 stars 43 forks source link

Feature Request: Support OAC between CloudFront and Lambda #217

Open davidw17 opened 2 weeks ago

davidw17 commented 2 weeks ago

Our organisation are using cdk-nextjs and for our security requirements, it would be beneficial to have OAC implemented between Cloudfront and the Lambdas vs the current edge solution. Now that OAC is available, just raising a feature request item to get this implemented if possible.

See: https://github.com/jetbridge/cdk-nextjs/blob/2d9c5a34ada73c97ff00f0dcacc365f892429c96/src/NextjsDistribution.ts#L223

francoisdtm commented 4 days ago

+1; I would also prefer to have OAC instead of lambda@edge. I can work on this change; do we want to keep the possibility to have lambda@edge, or move entirely to OAC ?

davidw17 commented 4 days ago

I think it would be handy to still be able to use lambda@edge as an option if possible.

bestickley commented 4 days ago

@francoisdtm, I don't think we can move to OAC because it does not support PUT or POST payloads. See the note below from the docs:

If you use PUT or POST methods with your Lambda function URL, your users must include the payload hash value in the x-amz-content-sha256 header when sending the request to CloudFront. Lambda doesn't support unsigned payloads.

If CloudFront allowed selecting different origins per method, then maybe we could for GETs but I don't think that's possible.