Retrieving JWT Claims from Amazon.Lambda.Annotations

[danielwagstaff]

Hi,

Using Amazon.Lambda.Annotations (great project, by the way!) is it possible to retrieve JWT claims, please?

Thanks to the annotations, the following code

public APIGatewayHttpApiV2ProxyResponse LambdaMathAdd(APIGatewayHttpApiV2ProxyRequest request, ILambdaContext context)
{
    if (!request.PathParameters.TryGetValue("x", out var xs))
    {
        return new APIGatewayHttpApiV2ProxyResponse
        {
            StatusCode = (int)HttpStatusCode.BadRequest
        };
    }
...

is reduced to

[LambdaFunction]
[HttpApi(LambdaHttpMethod.Get, "/add/{x}/{y}")]
public int Add(int x, int y, ILambdaContext context)
{
    return x + y;
}

In the "old" way of doing things, to retrieve JWT claims, I would use request.RequestContext.Authorizer.Jwt.Claims["EmailID"], but seeing as I no longer have access to APIGatewayHttpApiV2ProxyRequest request, how would I go about retrieving the EmailID from the JWT claims?

Many thanks in advance,
Dan

[ashishdhingra]

@danielwagstaff Amazon.Lambda.Annotations simplifies the programming model of writing Lambda functions, hiding the complexity of managing APIGatewayHttpApiV2ProxyRequest and APIGatewayHttpApiV2ProxyResponse objects. I'm unsure if currently it is possible to access the underlying request object, given that the underlying code is autogenerated from source generators.

CCing @normj for inputs.

[danielwagstaff]

Thank you for your reply @ashishdhingra,

I thought/hoped that JWT claims (coming from API Gateway, for example) would be accessible via the [FromHeader] attribute - although, as I say, I haven't been able to find any documentation on this.

Ideally, I'd be able to extract specific JWT claims that have been decoded.

Many thanks for your support,
Dan

[danielwagstaff]

It appears I'd missed a trick! I'm not in a position to deploy and test this at the moment, but by using dotPeek, I could look at the generated code.

If I update my test function to accept the APIGatewayHttpApiV2ProxyRequest object, like so:

    [LambdaFunction]
    [HttpApi(LambdaHttpMethod.Get, "/add/{x}/{y}")]
    public int Add(int x, int y, ILambdaContext context, APIGatewayHttpApiV2ProxyRequest proxyRequest)
    {
        var emailClaim = proxyRequest.RequestContext.Authorizer.Jwt.Claims["emailID"];

        return x + y;
    }

I can see that the source generated code is:

public Amazon.Lambda.APIGatewayEvents.APIGatewayHttpApiV2ProxyResponse Add(Amazon.Lambda.APIGatewayEvents.APIGatewayHttpApiV2ProxyRequest __request__, Amazon.Lambda.Core.ILambdaContext __context__)
{
    //skip the irrelevant code ...
    
    var response = signUpFunction.Add(x, y, __context__, __request__);

In other words, the APIGatewayHttpApiV2ProxyRequest object is passed to my Add function, and I can access all the bits I used to be able to 😄

Apologies if I'd been a bit dim by missing this, but it looks like I can indeed retrieve the decoded JWT Claims (and anything else from the API Gateway I want).

Many thanks,
Dan

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.