Injecting data to web application from AWS Lambda & CloudFront

Question

I am implementing an access manager for my application but have not yet been able to find an elegant solution to pass data from AWS Lambda to the client.

The user will attempt to reach https://myapplication.com/ which is pointing to the IP address of the access manager. The access manager will check if a session exists or prompt the user for a login. Once authenticated the access manager will fetch my application from CloudFront, with a Bearer token in the authorization header. On the viewer request I am validating that token with a Lambda function and if successful I return the application, otherwise I return a 401 error. Any viewer request that does not come from the access manager also returns a 401.

When validating the token I'm able to retrieve user info such as username, role, email etc. I would like to pass that data from Lambda through the viewer response to the client. What options do I have here? I have tried passing the data in headers but I don't believe that there is any way to view the initial page load headers in my application? I'm able to set the data as a cookie and access it that way but I think that is less secure. Maybe if I were to encrypt that data as a jwt, set it as a cookie and decrypt in the client?

My primary application is in Angular served from S3 via CloudFront. I also have a couple of Flask applications that I would like to hook up to the access manager afterwards.

Any pointers are appreciated.

Thanks!

Answer 1

You can create another API on your access manager that returns the existing session authenticated user details. Have the Angular application call the API.

Answer 2

There could be multiple solutions to this. Below are some of the solutions that come to my mind.

• Let your application also decipher the token like lambda and read the info
• Lambda can set the headers and you can pass those headers to your application via CloudFront (called whitelisting headers) ref: https://aws.amazon.com/premiumsupport/knowledge-center/configure-cloudfront-to-forward-headers/
• Create JWT (value) token from lambda and pass it to your app. Your app will decode JWT and get the values