1exports.handler = async (event) => {
2  const userAgent = event.headers["User-Agent"] || event.headers["user-agent"];
3  const auth = event.headers.Authorization || event.headers.authorization;
4
5  return {
6    statusCode: 200,
7    body: JSON.stringify({
8      userAgent,
9      authPresent: Boolean(auth),
10    }),
11  };
12};

1exports.handler = async (event) => {
2  console.log(JSON.stringify(event, null, 2));
3
4  return {
5    statusCode: 200,
6    body: "ok",
7  };
8};

exports.handler = async (event) => {
  const forwardedFor = event.multiValueHeaders?.["X-Forwarded-For"]
|| event.multiValueHeaders?.["x-forwarded-for"] || []; return { statusCode: 200, body: JSON.stringify({ forwardedFor }), }; }; ``` If you only read `event.headers`, repeated values may already be collapsed into a single comma-separated string depending on the gateway behavior. ## Custom Authorizers And Useful Headers Some headers are often used to drive downstream logic: - '`Authorization` for bearer tokens' - '`Content-Type` for body parsing rules' - '`X-Request-Id` for tracing' - '`X-Forwarded-For` for original client IP information' Read them from the event first, then validate them in code. Never assume the client sent a trustworthy value unless an upstream service is explicitly enforcing it. ## Python Example The same idea applies in Python. ```python def lambda_handler(event, context): headers = event.get("headers") or {} content_type = headers.get("Content-Type") or headers.get("content-type") return { "statusCode": 200, "body": f"content type: {content_type}" } ``` The defensive `or {}` pattern avoids crashes when `headers` is absent. It also makes local tests easier because a hand-written event payload may omit optional fields. ## Common Pitfalls The first common mistake is looking for headers in `requestContext`. Most ordinary HTTP headers arrive in `event.headers`, not in the context metadata. Another mistake is assuming exact case. API Gateway may normalize or preserve header names differently depending on the configuration, so code should tolerate both common variants. A third issue is not using proxy integration. If the endpoint is configured with a custom mapping template, headers may be moved or renamed before Lambda receives them. In that case, inspect the mapping template instead of blaming the Lambda runtime. ## Summary - In a typical 2018 API Gateway setup, Lambda request headers are in `event.headers`. - Treat header keys as case-insensitive when reading them. - Use `event.multiValueHeaders` if repeated headers matter. - Log the incoming event once to verify the actual payload shape. - Check mapping templates if the headers are not where you expect.