Hi all, I’m learning the Serverless Framework, serverless, and AWS in general through a little side project. Thanks for having this place for questions and chat! Here’s what I’m bumping up against right now:

functions:
  listShowNoteSets:
    handler: functions/listShowNoteSets.main
    events:
      - http:
          path: shownotes/{PK}
          method: get
          cors: true

A function definition like that, without

authorizer: aws_iam

in it should still be generally accessible by an unauthorized request? I’m getting a

Missing Authentication Token

message back. I can see in API Gateway where there is no authorization required for the path. The lambda function itself only reads data and works when I’m logged in with a Cognito user. Do you have any pointers where this could be blocked? Cognito seems like a spot but I haven’t gotten into that and it my next target. Thanks for any advice!

Hey @Kevin Clark, yup with out

authorizer: aws_iam

that api route should be publically accessible.

Thanks for your response @Frank: https://iel9rsxmzb.execute-api.us-west-2.amazonaws.com/dev/shownotes

based on the snippet u sent, the lambda is listening for

…/shownotes/{something}

Yes.

the url is hitting

…/shownotes

Aha, I am the fool in the corner! Thanks, I see what’s happening now on the front end. Thanks.

Np 👍

@Kevin Clark This is unfortunately a very common issue. And a horrible error message.

@Frank How did you test that url? What did you do to get the

…/shownotes/{something}

?

.../shownotes/1

would hit that. Is that what you meant?

No, sorry, I thought you somehow had a way to know that there was a

{something}

after

shownotes/

but maybe you just guessed based on context. I’m still finding my way around and debugging is one of those things where I’m a fish out of water here. Any tip I can find is gold which is why I asked.

Ah i see. Yeah, in the code snippet u shared, you had

- http:
          path: shownotes/{PK}

Oy, sorry, I missed your response. That makes sense. I want it to be

shownotes/{PK}

but I just never checked what the request url was in the network tab because I got distracted by the

Missing Authentication Token

error. Frank, thanks so much for the framework and your help!

Yeah, AWS error messages can be cryptic sometimes 👍