AWS Api Gateway Authorizer + Cognito User Pool Not Working {"message": "Unauthorized"}

user_8592351 0
Viewed 19156

I am trying to use aws api gateway authorizer with cognito user pool. It is working fine when i test using aws api gateway console.

But when i try enabling the authorization in the api it says "message": "Unauthorized". Please check below screenshot

API Gateway Console Screenshot - This works fine enter image description here

Postman Screen shot - Not working enter image description here

Can someone help please.

FYI I have followed the instructions as mentioned here http://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html

aws-api-gateway amazon-cognito amazon-web-services
10 Answers

In my case, authorization code should be id_token. I made a mistake for using access_token instead

user_46423160

The below steps fixes the problem for me. In short, there seems to be a bug in AWS API Gateway. You can fix it by re-deploy the API:

  1. Change the Request Validator from NONE to Validate Body
  2. Actions -> Deploy the API -> choose the stage you want to deploy it to.
  3. Change the Request Validator from Validate Body to NONE
  4. Redo step 2.

enter image description here

user_40565090

I had the same issue like you and realized that I entered a wrong Token Source.

Enter in <your API> -> Authorizers -> Token Source the name of the HTTP header where the API gateway has to look for the token. (in your case Authorization)

Save it and don't forget to deploy before you test it out.

enter image description here

user_83442020

Try below 3 steps (do not forget to deploy API) and try to send a request with POST man

  1. Cache

enter image description here

  1. Settings of Method Request

enter image description here

  1. Deploy API

enter image description here

user_17420030

If you are not checking scope at OAuth Scopes in method execution block of API gateway it will only take id-token.

Once you will have set OAuth scope restriction on request it will start taking access token automatically.

user_55258240
user_22317020

In my case, I thought that I needed to prepend the ID token in the authorization header with 'Bearer', after having looked at example documentation coming from Amplify. Removing 'Bearer' resolved my issue (and indeed the check for the token shape.) Also, check your CORS configuration!

user_39382160

Changing the Token Source in the Authorizer to something other than Authorization (eg: authorization) then deploying the API and giving that in Postman's headers worked for me. No matter what we call the header, it will be translated and used by API gateway I guess.

user_102679300
Related