{"id":18866399,"url":"https://github.com/nordcloud/cognito-authorizer","last_synced_at":"2025-04-14T14:31:09.873Z","repository":{"id":35506448,"uuid":"198413653","full_name":"nordcloud/cognito-authorizer","owner":"nordcloud","description":"Build your AWS API Gateway custom authorizer lambda without the need to handle tokens by yourself. Just implement the logic...","archived":false,"fork":false,"pushed_at":"2022-03-11T13:05:46.000Z","size":38,"stargazers_count":24,"open_issues_count":1,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-28T03:24:53.300Z","etag":null,"topics":["aws-cognito","cognito"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nordcloud.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-07-23T11:06:52.000Z","updated_at":"2024-02-26T10:47:46.000Z","dependencies_parsed_at":"2022-08-08T09:00:51.903Z","dependency_job_id":null,"html_url":"https://github.com/nordcloud/cognito-authorizer","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fcognito-authorizer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fcognito-authorizer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fcognito-authorizer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fcognito-authorizer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nordcloud","download_url":"https://codeload.github.com/nordcloud/cognito-authorizer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248897085,"owners_count":21179534,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-cognito","cognito"],"created_at":"2024-11-08T05:06:26.379Z","updated_at":"2025-04-14T14:31:09.452Z","avatar_url":"https://github.com/nordcloud.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/nordcloud/cognito-authorizer.svg?branch=master)](https://travis-ci.org/nordcloud/cognito-authorizer) [![Go Report Card](https://goreportcard.com/badge/github.com/nordcloud/cognito-authorizer)](https://goreportcard.com/report/github.com/nordcloud/cognito-authorizer)\n\n# Cognito authorizer\nA golang packages that abstract out work with JSON web access/identity tokens for AWS API Gateway custom authorizer.\n\nThese packages handle:\n\n- access, id and standard tokens\n- token verification\n- token payload decrypting (claims)\n- building proper responses from a custom authorizer\n- a M2M token signer helper\n\nYou don't need to worry about JWT. The `GetIDClaims`, `GetAccessClaims` and `GetStandardClaims` will do the work for you, so you can focus only on building `APIGatewayCustomAuthorizerPolicy`.\n\n### Docs\n\n- [authorizer](https://godoc.org/github.com/nordcloud/cognito-authorizer/pkg/authorizer#pkg-index)\n- [default builder](https://godoc.org/github.com/nordcloud/cognito-authorizer/pkg/authorizer/builder)\n- [request signer](https://godoc.org/github.com/nordcloud/cognito-authorizer/pkg/request/auth)\n\n\n### About resource server context\nYou can pass a context created by your custom authorizer to the resource server. This is done by satisfying ContextBuilder interface. The method should return a `map[string]interface{}` (this is how AWS golang SDK works) but keys and values in this map have to be *strings*. More info [here](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html).\n\n\n## Example\n\nCustom authorizer main package\n```go\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"os\"\n\t\"strings\"\n\n\t\"github.com/aws/aws-lambda-go/events\"\n\t\"github.com/aws/aws-lambda-go/lambda\"\n\tlog \"github.com/sirupsen/logrus\"\n\n\tcognitoAuthorizer \"github.com/nordcloud/cognito-authorizer/pkg/authorizer\"\n)\n\ntype PolicyEffect string\n\nconst (\n\tallow PolicyEffect = \"allow\"\n\tdeny  PolicyEffect = \"deny\"\n)\n\ntype Policy struct {\n\tContext *cognitoAuthorizer.Context\n}\n\nfunc (b Policy) BuildPolicy(encodedToken string) (events.APIGatewayCustomAuthorizerPolicy, error) {\n\taccessClaims := \u0026cognitoAuthorizer.AccessTokenClaims{}\n\terr := cognitoAuthorizer.GetAccessClaims(encodedToken, b.Context.DecryptionKeys, accessClaims)\n\tif err != nil {\n\t\treturn events.APIGatewayCustomAuthorizerPolicy{}, err\n\t}\n\n\tresources := []string{\n\t\tfmt.Sprintf(\n\t\t\t\"arn:aws:execute-api:%s:*:%s/%s/*/*\",\n\t\t\tb.Context.Region,\n\t\t\tb.Context.ApplicationID,\n\t\t\tb.Context.Stage,\n\t\t),\n\t}\n\n\tpolicy := events.APIGatewayCustomAuthorizerPolicy{\n\t\tVersion: \"2012-10-17\",\n\t\tStatement: []events.IAMPolicyStatement{\n\t\t\t{\n\t\t\t\tAction:   []string{\"execute-api:Invoke\"},\n\t\t\t\tEffect:   string(allow),\n\t\t\t\tResource: resources,\n\t\t\t},\n\t\t},\n\t}\n\n\treturn policy, nil\n}\n\nfunc (b Policy) BuildContext(encodedToken string) (map[string]interface{}, error) {\n\taccessClaims := \u0026cognitoAuthorizer.AccessTokenClaims{}\n\terr := cognitoAuthorizer.GetAccessClaims(encodedToken, b.Context.DecryptionKeys, accessClaims)\n\tif err != nil {\n\t\treturn map[string]interface{}{}, err\n\t}\n\n\tcontext := map[string]interface{}{\n\t\t\"token_scope\": accessClaims.Scope,\n\t}\n\n\treturn context, nil\n}\n\nvar (\n\tsharedContext *cognitoAuthorizer.Context\n)\n\n// Init is called on lambda cold start. In this function we pull Cognito keys to verify tokens.\nfunc init() {\n\tsharedContext = \u0026cognitoAuthorizer.Context{\n\t\tRegion:            os.Getenv(\"REGION\"),\n\t\tApplicationID:     os.Getenv(\"API_APPLICATION_ID\"),\n\t\tStage:             os.Getenv(\"API_STAGE\"),\n\t\tAllowedUserPoolID: os.Getenv(\"API_ALLOWED_USER_POOL_ID\"),\n\t\tCognitoClients:    strings.Split(os.Getenv(\"COGNITO_CLIENTS\"), \",\"),\n\t\tDecryptionKeys:    nil,\n\t}\n\n\tkeys, err := cognitoAuthorizer.GetDecryptionKeys(sharedContext.Region, sharedContext.AllowedUserPoolID)\n\tif err != nil {\n\t\tlog.WithField(\"error\", err).Error(\"Unable to get decryption keys.\")\n\t}\n\n\tsharedContext.DecryptionKeys = keys\n\n\tlog.WithFields(log.Fields{\n\t\t\"region\":               sharedContext.Region,\n\t\t\"application_id\":       sharedContext.ApplicationID,\n\t\t\"stage\":                sharedContext.Stage,\n\t\t\"allowed_user_pool_id\": sharedContext.AllowedUserPoolID,\n\t\t\"cognito_clients\":      sharedContext.CognitoClients,\n\t}).Info(\"Finished initialization.\")\n}\n\nfunc handler(ctx context.Context, event events.APIGatewayCustomAuthorizerRequest) (\n\tevents.APIGatewayCustomAuthorizerResponse, error) {\n\tlog.WithField(\"method_arn\", event.MethodArn).Info(\"Authorizer lambda invoked.\")\n\n\tpolicy := \u0026Policy{\n\t\tContext: sharedContext,\n\t}\n\n\tresponseBuilder := \u0026cognitoAuthorizer.ResponseBuilder{\n\t\tContext:        sharedContext,\n\t\tPolicyBuilder:  policy,\n\t\tContextBuilder: policy,\n\t}\n\n\treturn responseBuilder.BuildResponse(event.AuthorizationToken)\n}\n\nfunc main() {\n\tlambda.Start(handler)\n}\n```\n## Authors\n- Grzegorz Bednarski, Nordcloud 🇵🇱\n- Kamil Piotrowski, Nordcloud 🇵🇱\n- Artur Kowalski, Nordcloud 🇵🇱\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnordcloud%2Fcognito-authorizer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnordcloud%2Fcognito-authorizer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnordcloud%2Fcognito-authorizer/lists"}