Using Lambda Authorizers with AWS Websockets

Understand how Auth works and how to deploy it

Photo by Jason Leung on Unsplash

In my last post, we learned how to create a WebSocket API in AWS. We stood up a functional API that we can connect to and send messages from. But that was only a piece of the puzzle.

Now that we are started with WebSockets, we have to talk about security. Really we should have started with security, but that ship has sailed. We don’t want malicious users connecting to our API and attempt to take us down with a DDoS or injection attempts.

Today we are going to take what we created last week and add a lambda authorizer to it to make sure everyone who connects is a valid user of the system.

Understanding WebSocket Auth

You might be thinking to yourself, “why is this post even a thing? I know how to add a lambda authorizer to an API.”

While that might be true, there are some gotchas specific to WebSockets that you need to know. Most front-end JavaScript libraries that connect to WebSockets don’t really support standard Authorization headers.

The WebSocket API only supports the Sec-WebSocket-Protocol header when establishing a connection. Tools like Postman allow you to pass in other headers when making a connection (which is a good thing!), but when you get to writing the code for the front-end in your app, you will be stopped immediately.

To work around this while still providing us a way to connect securely, we have two options:

• Provide delimited values in the Sec-WebSocket-Protocol header
• Provide the auth token in an access_token query string parameter

Both approaches have pros and cons, and ultimately the decision is yours to make. The solution we have deployed into our AWS accounts supports both approaches. I recommend using the query string parameter approach because it is straightforward does not repurpose the Sec-WebSocket-Protocol header.

So instead of the standard Authorization header when establishing a new connection, we will pass in a query string parameter called access_token that contains our jwt.