https://serverless-stack.com/ logo
Join Slack
Powered by
Hey guys, shouldn't `auth.attachPermissionsForUnau...
# help
s
Hey guys, shouldn't 
auth.attachPermissionsForUnauthUsers([api])
allow unauthenticated users access to my api? Api endpoints returns 
{"message":"Forbidden"}
if I am unauthenticated. Am I missing something? Thanks!
I even tried this, same problem.
Copy code
const policy = new iam.Policy(this, "AuthPolicy", {
            statements: [
                new iam.PolicyStatement({
                    effect: iam.Effect.ALLOW,
                    actions: ["execute-api:Invoke"],
                    resources: [`arn:aws:execute-api:${scope.region}:${scope.account}:${api.httpApiId}/*`]
                })
            ],
        });
        policy.attachToRole(this.auth.iamUnauthRole)
d
Not sure it f this could help: Maybe you have some 
authorizationType
on your route. I removed the default auth type from the API and add it individually on the routes:
Copy code
'GET /unprotected': {
  function: 'src/test.main',
},

'GET /protected': {
  authorizationType: ApiAuthorizationType.AWS_IAM,
  function: 'src/test.main',
},
s
Yes I have IAM authorizationType, but isn't it supposed to work with that?
d
If you have set globally for ALL the routes to use ApiAuthorizationType.AWS_IAM then all your routes will require authorization of that type.
To my understanding, and I might be wrong here, you can’t at the same time: • enforce ApiAuthorizationType.AWS_IAM authentication • allow unauthenticated users My understanding - again could be wrong here : • 
authorizationType
defines how your route is protected (the route itself) • 
attachPermissionsForUnauthUsers
defines the resources an unauth user could access
s
Oh, thanks for your input!
d
For my non auth’d routes I have
Copy code
"POST     /beta-signup": {
          authorizationType: sst.ApiAuthorizationType.NONE,
          function: "src/betaSignUp.main" 
        },
that’s basically a newsletter signup on an API that has mostly auth’d routes
s
I don't want to use 
sst.ApiAuthorizationType.NONE
because I want to check in the function whether the user is authenticated or not.
d
Gotcha sorry I misunderstood the problem
f
Hey guys, just to clear up some confusion, 
auth.attachPermissionsForUnauthUsers([api])
will allow non-authed users to access the Api, both NONE and IAM authorized routes.
@Sam are you still getting the Forbidden error?
s
Thanks @Frank Yes, I'm still getting the 403 Forbidden error.
f
Hey @Sam can you check the 
x-amzn-errortype
response header and see if any of the following tips help? https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-troubleshoot-403-forbidden/
Oh btw, for not logged in users, are you generating IAM credentials for them? Note that you’d still have to do that similar to how you are generating the credentials for the logged in users.
s
Thanks a lot@Frank, Yes I resolved this issue by calling Auth.currentCredentials() on frontend, I am new to all of this, I thought it would work without credentials. 😅 Now I can use the same API endpoint for both authed and non authed users.
f
Awesome!
2 Views
Open in Slack
PreviousNext
Powered by