Custom authorizer error not returned to client

Serverless Framework
1

I am running into some issues when using a custom authorizer for my Serverless Framework endpoints.

I followed the docs listed here: https://serverless.com/framework/docs/providers/aws/events/apigateway/#http-endpoints-with-custom-authorizers and I am able to get my requests to go through if the user is authenticated and they are rejected if the token is invalid so all good there.

My issue is that, from my authorizer handler, I return return new Error('[401] Unauthorized') if the token is invalid, but that doesn’t seem to make its way to the client. As per the docs (https://serverless.com/framework/docs/providers/aws/events/apigateway/#using-status-codes) I would expect the client to receive a response of 401 but instead they get a 500 with a payload of {"message":null}.

Any help would be greatly appreciated. Thanks!

2

Those status codes only apply to Lambda’s handling requests from the API Gateway and not the custom authorizers. See https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html for an example of how to trigger a 401 response from a custom authorizer.