Examples: Add cognito oauth integration about jrestless HOT 2 CLOSED

Hi @spinscale ,
There are multiple ways to accomplish this:

1. if you just don't want to mange users, Cognito User Pool might be interesting for you. You can protect API endpoints with a Cognito User Pool Authorizer. In case of JRestless >=0.5.0 CognitoUserPoolAuthorizerPrincipal will be set as principal. See the example aws-gateway-security-cognito-authorizer. You, however, cannot integrate any other providers.
2. what you most likely want to do is to set up a custom authorizer function, like in the example: aws-gateway-security-custom-authorizer. In contrast to the example, however, your authorizer function would verify the twitter/github/amazon token. In case you want to make your life a little easier, use auth0 which integrates with the major providers. You can find an example for such a custom auth0 authorizer here: https://github.com/serverless/examples/blob/master/aws-node-auth0-custom-authorizers-api/handler.js but even without using auth0 it boils down to verifying the JWT token's signature which can be a little tricky: https://developers.google.com/identity/protocols/OpenIDConnect#validatinganidtoken but there are libraries for this, too, I guess. In case of JRestless >=0.5.0 CustomAuthorizerPrincipal will be set as principal.
3. if and only if you invoke your endpoints through the API Gateway SDK you might want to take a look at Cognito Federated Identites which integrates with all major providers. In case of JRestless >= 0.5.1 CognitoIdentityPrincipal will be set as principal. I am working on an example for this but it's a little tricky and uncommon on Web, and I am very short on time right now.

And last but not least the way AWS implemented those authorizers there is some issue with CORS:
You cannot setup any CORS headers which is an issue if the authorizer fails: https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660
In case this is an issue for you, you might want to pull in the authorization into some ContainerRequestFilter (JAX-RS) within your application.

Hope this helps.

from jrestless.

closing since inactive (please re-open if required)

from jrestless.