In AWS API Gateway, using Custom Authorizer Lambda Functions is a common way to control access to your APIs. However, one frequent challenge developers face is accessing the request body or POST data within the authorizer. By default, API Gateway and Lambda do not make the body of a POST request available to the authorizer function. This article will explore how to handle this limitation and offer solutions to access the POST request body in a Custom Authorizer Lambda Function.

Understanding Custom Authorizers

Custom Authorizers in API Gateway allow developers to implement complex and custom authorization strategies, executed before the backend integration. When an API Gateway endpoint is called, it invokes the custom Lambda authorizer, which returns an authorization response (IAM policy) allowing or denying access to the API.

Limitation in Accessing Request Body

The Lambda authorizer is executed before the actual API endpoint. API Gateway sends limited information to the authorizer, primarily focused on HTTP headers, query string parameters, and context metadata. The request body, especially in POST requests, is not available by design due to the sequence in which AWS processes requests. The API Gateway invokes the authorizer before forwarding the request to the API, hence leaving the body out of the authorizer context.

Workaround Solutions

To access the POST request body in an authorizer, consider these workarounds:

1. Use Headers or Query Parameters

If the authorizer must make decisions based on certain data from the request body, consider passing essential data via HTTP headers or query string parameters. This is a common pattern when having minimal essential data.

Example:

• Pre-process Lambda: Create a Lambda function to handle requests before the Custom Authorizer. This Lambda can inspect the request body, validate the necessary conditions, and set appropriate headers or context variables to be used by the subsequent authorizer.
• Data Sensitivity: Ensure that sensitive information (like passwords or tokens) is never exposed in headers.
• Encryption: Use TLS (HTTPS) to protect data being transmitted both in headers and the body.
• Validation: Implement thorough validation in your Lambda functions to prevent injection attacks or malformed data from being processed.