I have an application using A REST API Gateway in AWS. That API has a few resources, two of them are as follows
- {{API_URL}}/{{API_STAGE}}/show-data (GET Method) – This endpoint triggers a lambda function that returns an index.html containing jQuery Datatable which then calls the get-data endpoint through POST Method using AJAX.
- {{API_URL}}/{{API_STAGE}}/get-data (POST Method) – This endpoint triggers a lambda, gets some information from S3 bucket and then sends the JSON response.
A brief about my implementation.
Following this tutorial I created a Token Based Lambda Authorizer and added it to get-data endpoint in the REST API. This restricts anyone who doesn’t have the Bearer Token to access this endpoint. Therefore making it private.
Next in show-data endpoint using AJAX I am calling the get-data endpoint. When this request is made, anyone can inspect the page, go to the Networks Tab and see all the Request Headers which also includes the sent Token in Authorization Header. Not just that, if anyone checks the source of the page, they will be able to see the code/token added as a header in Ajax Configuration.
So I am stuck trying to make the show-data endpoint secure.
Code of Lambda Function Triggered through show-data
index.js
const fs = require('fs');
const html = fs.readFileSync('index.html', { encoding:'utf8' });
const generateHTMLTable = async () => {
const table = `<table id="reportTable" class="display"><thead><tr>{thead}</tr></thead><tbody>{tbody}</tbody><tfoot>{tfoot}</tfoot></table>`;
const thead = `<th>S.No</th><th>Code</th><th>Name</th><th>Status</th><th>Date</th>`;
let tbody = "";
return table.replace("{thead}", thead).replace("{tbody}", tbody).replace("{tfoot}", thead);
}
module.exports.showData = async () => {
const reportTable = await generateHTMLTable();
const modifiedHTML = html.replace("{table}", reportTable);
return {
statusCode: 200,
headers: {
'Content-Type': 'text/html',
},
body: modifiedHTML
}
}
index.html (ajax code)
var table = $('#reportTable').DataTable(
{
processing: true,
serverSide: true,
serverMethod: 'POST',
dataType: 'json',
ajax: {
url: 'get-data',
dataSrc: 'data',
dataType: 'JSON',
data: function(d){
return JSON.stringify(d);
},
headers: {
"Accept" : "application/json",
"Content-Type": "text/json; charset=utf-8",
// Here is the Authorization Token Passed which can be seen if someone sees the source.
"Authorization":"Bearer **********************",
}
},
dom: 'Bfrtip',
select: true,
}
);
Problem in Hand
How do I make the show-data lambda secure?