AWS apigatewayv2 documentation change
Summary
Updated authorizer parameters documentation, including adding fields like authorizerCredentialsArn, adjusting parameter order, and changing 'identitySource' from required (True) to optional (False).
Security assessment
The changes document security-related parameters (e.g., credentials ARN, TTL settings) but do not address a specific security vulnerability. The 'identitySource' requirement change aligns documentation with actual API behavior rather than fixing a security issue.
Diff
diff --git a/apigatewayv2/latest/api-reference/apis-apiid-authorizers.md b/apigatewayv2/latest/api-reference/apis-apiid-authorizers.md index 196609910..74f9f7713 100644 --- a//apigatewayv2/latest/api-reference/apis-apiid-authorizers.md +++ b//apigatewayv2/latest/api-reference/apis-apiid-authorizers.md @@ -63 +63,3 @@ ResponsesStatus code| Response model| Description - "name": "string", + "authorizerCredentialsArn": "string", + "authorizerPayloadFormatVersion": "string", + "authorizerResultTtlInSeconds": integer, @@ -66 +68 @@ ResponsesStatus code| Response model| Description - "authorizerCredentialsArn": "string", + "enableSimpleResponses": boolean, @@ -71 +72,0 @@ ResponsesStatus code| Response model| Description - "authorizerResultTtlInSeconds": integer, @@ -73 +73,0 @@ ResponsesStatus code| Response model| Description - "issuer": "string", @@ -76 +76,2 @@ ResponsesStatus code| Response model| Description - ] + ], + "issuer": "string" @@ -78,2 +79 @@ ResponsesStatus code| Response model| Description - "authorizerPayloadFormatVersion": "string", - "enableSimpleResponses": boolean + "name": "string" @@ -87,0 +88 @@ ResponsesStatus code| Response model| Description + "authorizerCredentialsArn": "string", @@ -89 +90,2 @@ ResponsesStatus code| Response model| Description - "name": "string", + "authorizerPayloadFormatVersion": "string", + "authorizerResultTtlInSeconds": integer, @@ -92 +94 @@ ResponsesStatus code| Response model| Description - "authorizerCredentialsArn": "string", + "enableSimpleResponses": boolean, @@ -97 +98,0 @@ ResponsesStatus code| Response model| Description - "authorizerResultTtlInSeconds": integer, @@ -99 +99,0 @@ ResponsesStatus code| Response model| Description - "issuer": "string", @@ -102 +102,2 @@ ResponsesStatus code| Response model| Description - ] + ], + "issuer": "string" @@ -104,2 +105 @@ ResponsesStatus code| Response model| Description - "authorizerPayloadFormatVersion": "string", - "enableSimpleResponses": boolean + "name": "string" @@ -112,0 +113 @@ ResponsesStatus code| Response model| Description + "authorizerCredentialsArn": "string", @@ -114 +115,2 @@ ResponsesStatus code| Response model| Description - "name": "string", + "authorizerPayloadFormatVersion": "string", + "authorizerResultTtlInSeconds": integer, @@ -117 +119 @@ ResponsesStatus code| Response model| Description - "authorizerCredentialsArn": "string", + "enableSimpleResponses": boolean, @@ -122 +123,0 @@ ResponsesStatus code| Response model| Description - "authorizerResultTtlInSeconds": integer, @@ -124 +124,0 @@ ResponsesStatus code| Response model| Description - "issuer": "string", @@ -127 +127,2 @@ ResponsesStatus code| Response model| Description - ] + ], + "issuer": "string" @@ -129,2 +130 @@ ResponsesStatus code| Response model| Description - "authorizerPayloadFormatVersion": "string", - "enableSimpleResponses": boolean + "name": "string" @@ -151,2 +151,2 @@ ResponsesStatus code| Response model| Description - "message": "string", - "limitType": "string" + "limitType": "string", + "message": "string" @@ -223 +223 @@ Property| Type| Required| Description -`identitySource`| Array of type string| True| The identity source for which authorization is requested.For a `REQUEST` authorizer, this is optional. The value is a set of one or more mapping expressions of the specified request parameters. The identity source can be headers, query string parameters, stage variables, and context parameters. For example, if an Auth header and a Name query string parameter are defined as identity sources, this value is route.request.header.Auth, route.request.querystring.Name for WebSocket APIs. For HTTP APIs, use selection expressions prefixed with `$`, for example, `$request.header.Auth`, `$request.querystring.Name`. These parameters are used to perform runtime validation for Lambda-based authorizers by verifying all of the identity-related request parameters are present in the request, not null, and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function. Otherwise, it returns a 401 Unauthorized response without calling the Lambda function. For HTTP APIs, identity sources are also used as the cache key when caching is enabled. To learn more, see [Working with AWS Lambda authorizers for HTTP APIs](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html).For `JWT`, a single entry that specifies where to extract the JSON Web Token (JWT) from inbound requests. Currently only header-based and query parameter-based selections are supported, for example `$request.header.Authorization`. +`identitySource`| Array of type string| False| The identity source for which authorization is requested.For a `REQUEST` authorizer, this is optional. The value is a set of one or more mapping expressions of the specified request parameters. The identity source can be headers, query string parameters, stage variables, and context parameters. For example, if an Auth header and a Name query string parameter are defined as identity sources, this value is route.request.header.Auth, route.request.querystring.Name for WebSocket APIs. For HTTP APIs, use selection expressions prefixed with `$`, for example, `$request.header.Auth`, `$request.querystring.Name`. These parameters are used to perform runtime validation for Lambda-based authorizers by verifying all of the identity-related request parameters are present in the request, not null, and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function. Otherwise, it returns a 401 Unauthorized response without calling the Lambda function. For HTTP APIs, identity sources are also used as the cache key when caching is enabled. To learn more, see [Working with AWS Lambda authorizers for HTTP APIs](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html).For `JWT`, a single entry that specifies where to extract the JSON Web Token (JWT) from inbound requests. Currently only header-based and query parameter-based selections are supported, for example `$request.header.Authorization`.