How to exclude certain header from API Gateway Mapping Template

user_3862378 0
Viewed 226

In AWS API Gateway i have created an API. I have the folowing Mapping template defined for appliction/json content type in Integration Request. 

#set($allParams = $input.params())
{
    "body-json" : $input.json('$'),
    "params" : {
        #foreach($type in $allParams.keySet())
            #set($params = $allParams.get($type))
        "$type" : {
            #foreach($paramName in $params.keySet())
            "$paramName" : "$util.escapeJavaScript($params.get($paramName))"
                #if($foreach.hasNext),#end
            #end
        }
            #if($foreach.hasNext),#end
        #end
    },
    "stage-variables" : {
        #foreach($key in $stageVariables.keySet())
        "$key" : "$util.escapeJavaScript($stageVariables.get($key))"
            #if($foreach.hasNext),#end
        #end
    }
}

This template mapping forwards all the headers to backend endpoint including x-api-key in clear text.

How do i exclude x-api-key from header?

aws-api-gateway aws-lambda amazon-web-services
1 Answers

Not so sure about excluding, but I did something like this:

"headers": {
    #foreach($param in $input.params().header.keySet())
         #if($param.toLowerCase() == "x-api-key")
            "$param": "API Key authentication"
         #else
            "$param": "$util.escapeJavaScript($input.params().header.get($param))" 
         #end
         #if($foreach.hasNext),#end
    #end  
}

This way you do not end up exposing x-api-key header value to your lambda function but for sure know that authentication method that was used is API Key.

user_127398910
Related