Use ApiGateway Authorizer to Validate Github Payload Signature (X-Hub-Signature)

user_8370660 0
Viewed 851

I am currently working on a simple api to receive Github event payloads, and I want to validate that they are coming from the correct source. With this I am working to use the hmac signature in the requests header (generated by github using a secret provided by me). To validate the signature, the ApiGateway authorizer requires the signature (X-Hub-Signature), the secret used to generate the signature, and the body of the message. As far as I can tell, Api Gateway does not allow you to pass the body to an ApiGateway Authorizer. Does anyone know a way around this that does not require additional proxy lambdas and s3?

*Note: The requester is the Github Webhook service (not able to add body to header)

Basic ApiGateway Auth Docs: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html

lambda-authorizer aws-api-gateway amazon-cloudformation amazon-web-services
1 Answers

Here is how you do it.

Pass your content to Authorization header of your incoming request, It will get delivered to your custom Authorizer.

Grab the contents of the from the below attribute,

event.authorizationToken

where event is one of the parameters (1st) passed to lambda,

I currently encrypt and add all the info to that header and gets delivered to the Custom Authorizer lambda.

You can also access additional parameters as below in your custom Authorizer lambda:

var headers = event.headers;
var queryStringParameters = event.queryStringParameters;
var pathParameters = event.pathParameters;
var stageVariables = event.stageVariables;
var requestContext = event.requestContext;

Hope it helps.

user_2994620
Related