Open
Description
By default the websocket is open for anyone to connect too.
Think it would be better practice if there was a basic lambda that maybe could verify a token of some sort? Like the example seen here https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html
exports.handler = async(event) => {
let response = {
"isAuthorized": false,
"context": {
"stringKey": "value",
"numberKey": 1,
"booleanKey": true,
"arrayKey": ["value1", "value2"],
"mapKey": {"value1": "value2"}
}
};
if (event.headers.authorization === "secretToken") {
response = {
"isAuthorized": true,
"context": {
"stringKey": "value",
"numberKey": 1,
"booleanKey": true,
"arrayKey": ["value1", "value2"],
"mapKey": {"value1": "value2"}
}
};
}
return response;
};Maybe the websocket could send a authorization header, then we could allow the connection if it matches....
Metadata
Metadata
Assignees
Labels
No labels