Missing Authentication Token Error with CloudFront & API Gateway

5
votes

I have setup a CloudFront Distribution with an API Gateway as one of the origins and this API Gateway is configured with an AWS IAM authorizer.

When CloudFront url is invoked with Authorization headers, it returns a 403 error.

{
    "message": "Missing Authentication Token"
}

However, when the API Gateway url is invoked instead of CloudFront url with the same Authorization headers, it worked.

I've also tried invoking the endpoint without any authorizer via CloudFront url and it worked. Any idea on how to solve this issue.

1
amazon-web-servicesamazon-cloudfrontaws-api-gateway
In the CloudFront Cache Behavior that routes to API Gateway, did you whitelist the Authorization header for forwarding? CloudFront removes most headers by default. – Michael - sqlbot
Hi @Michael-sqlbot, adding Authorization header into the whitelist did work. Thanks – Shamal Perera
This answer might also help, it helped me: stackoverflow.com/a/53804396/728602 – Cadell Christo

1 Answers

6
votes

When provisioning a CloudFront distribution, remember that CloudFront removes most headers from the request by default.

This is done to optimize the cache hit ratio while preventing your origin server from making decisions based on those headers that would not be appropriate for different requests based on other variations (or absence) of those headers, which CloudFront would then serve from cache, inappropriately.

You'll need to whitelist the Authorization header for forwarding to the origin.

Note also that when provisioning API Gateway behind a CloudFront distribution that you control, you'll probably want to deploy your API endpoint as regional and not edge-optimized.