search

mlops-club / awscdk-minecraft

An AWS CDK package written in Python for deploying an entire Minecraft Server Platform-as-a-Service
Other
13 stars 4 forks source link

Feat/authentication and cors #36

Closed phitoduck closed 1 year ago

phitoduck commented 1 year ago

Wow... I just went on a 2-day journey.

I was beaten down by CORS, Cognito, and API Gateway, and emerged a new man.

  1. took forever to figure out how to use our JWT auth tokens with the generated client code.
  2. Got my locally running frontend to hit my deployed backend with Cognito for JWT protection. Exciting!
  3. Deployed the frontend to AWS to see if the token-authorized requests worked from there. No. then got 401 unauthorzed in the browser... yet it worked from Postman found out it was a CORS problem. The "CORS preflight" request was getting 401 unauthorized, causing the actual API calls to fail in the browser, even though they had auth tokens. (see the diagram)
  4. Realized that I needed to create a way for the OPTIONS preflight request to make it through withoug needing an auth token, but without invoking our lambda function either, so that attackers can't spoof us with 1,000's of OPTIONS requests that we'd have to pay money for
  5. Created a "MockIntegration" endpoint in API gateway that returns CORS for OPTIONS requests--had to abandon our apigateway.LambdaRestAPI construct for that and write our API Gateway from scratch.
  6. Still failed--due to a mysterious 500 error in the MockIntegration endpoint. Despair setting in.
  7. Learned of a limitation involving the specific use case of CORS with MockIntegrations :anguished:
  8. Learned the basics of a templating language called "Apache Velocity"--sort of like Jinja, and wrote a custom "response mapping" for API gateway--basically a transformation that worked around the CORS issue.
  9. Tested it manually. Success! ✅