如何使用AWS Cognito Userpool令牌登录到AWS Api网关？

Question

I have created an API gateway endpoint with a lambda function at the backend. Then I created a cognito userpool with one account and configured the cognito userpool as authorizer in API Gateway. I could see that the API was unauthorized.

Then I created a small web page with AWS Cognito Javascript SDK to log into the userpool and get an access token. I was able to do that successfully. Here is the code.

  var authenticationData = { Username : 'username', Password : 'test123', }; var authenticationDetails = new AuthenticationDetails(authenticationData); var poolData = { UserPoolId : 'ap-southeast-2_12312', // Your user pool id here ClientId : '434324324' // Your client id here }; var userPool = new CognitoUserPool(poolData); var userData = { Username : 'username', Pool : userPool }; var self = this; var cognitoUser = new CognitoUser(userData); cognitoUser.authenticateUser(authenticationDetails, { onSuccess: function (result) { var tok = result.getAccessToken().getJwtToken(); console.log('access token + ' + tok); self.setState({ token: tok }); //POTENTIAL: Region needs to be set if not already set previously elsewhere. // AWS.config.region = '<region>'; // AWS.config.credentials = new AWS.CognitoIdentityCredentials({ // IdentityPoolId : '...', // your identity pool id here // Logins : { // // Change the key below according to the specific region your user pool is in. // 'cognito-idp.<region>.amazonaws.com/<YOUR_USER_POOL_ID>' : tok // } // }); // Instantiate aws sdk service objects now that the credentials have been updated. // example: var s3 = new AWS.S3(); }, onFailure: function(err) { alert(err); }, }); 

This code works and gives me a JWT Token. However that token does not authorizes me into the API. I am passing the token in the Authorization header without the Bearer keyword but I still cannot access the API. How can I do that?

Answer 1

You might be able to debug more easily using the 'Test' feature for authorizers in the API Gateway console. You can paste the valid JWT token there and run a test on the authorizer; if there are any issues you should see them in the Logs output.