如何将 Cognito 令牌传递到 Amazon API Gateway？

Question

I'm developing web app based on Amazon API Gateway. Now I created Facebook login and successfully logged into website. but when I call another API, everything gone. I think I should pass Cognito token when call API everytime. am I right?

if yes, how to pass Cognito token to API? like header? or another way?

Thanks,

Answer 1

You are using the "Basic Authflow" from cognito identity, which means you will need to get credentials for your users by calling STS's "AssumeRoleWithWebIdentity". Here is some documentation to help: http://docs.aws.amazon.com/cognito/devguide/identity/concepts/authentication-flow/

Once you have credentials, you can instantiate the API Gateway Client:

var client = apigClientFactory.newClient({ 
    accessKey: ACCESS_KEY, 
    secretKey: SECRET_KEY, 
    sessionToken: SESSION_TOKEN });

The keys and tokens come from the result of the "AssumeRoleWithWebIdentity" call.

If you have configured your IAM roles, and Authorizations correctly you should be able to access your API.

Here is the documentation describing how to configure the roles & authorization: http://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-method-settings.html#how-to-method-settings-callers-console

Also, here is how to enable CORS - http://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.html