# \[Fixed\] Authorizer with specified header

**URL:** <https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981>\
**Category:** Serverless Framework\
**Created:** [October 29, 2017, 3:54am UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981 "2017-10-29T03:54:38Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [October 29, 2017, 3:54am UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/1 "2017-10-29T03:54:38Z")

</div>

I understand that I can:

1. enable `private: true` to set API keys
2. enable `authorizer: aws_iam` with aws iam
3. enable `authorizer: auth` for custom authorizer

But I need to use a custom header in autohrizer. What should I do?

I test with `authorizer: auth` but I found the `event` has only three parts: authorizationToken, type and methodArn, no other headers are transfered to the event.

```
{  
    type: 'TOKEN',
    methodArn: 'arn:aws:execute-api:::tnav0j/dev/GET/profile',
    authorizationToken: 'allow' 
}

```

So what should I do to authorise a custom header?

For example,

```
curl --header "X-token: abcd" ${API_Gateway}

```

This way is similar as x-api-key, but how to use for other headers?

---

<div class="post-metadata">

**Author:** ![alexdebrie1](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/alexdebrie1/32/899_2.png) [@alexdebrie1](https://forum.serverless.com/u/alexdebrie1)\
**Post date:** [October 29, 2017, 6:15pm UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/2 "2017-10-29T18:15:33Z")

</div>

Hey @bill,

If I understand your question correctly, the syntax would be something like:

```auto
          authorizer:
            name: authorizerFunc # <-- Function name or ARN
            resultTtlInSeconds: 0
            identitySource: method.request.header.X-token # <-- custom header
            identityValidationExpression: someRegex
            type: token

```

Does that help?

For reference, [here are docs on Serverless custom authorizer settings](https://serverless.com/framework/docs/providers/aws/events/apigateway#http-endpoints-with-custom-authorizers).

---

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [October 29, 2017, 10:27pm UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/3 "2017-10-29T22:27:03Z")

</div>

Thanks a lot, @alexdebrie1 That’s what I am looking for.

Finally I realised, whatever I transfer the header with other name in `identitySource`, in aws event, it is still called `authorizationToken`, and I still need to use `event.authorizationToke` to catch its value.

That explains why my code `event.headers["X-token"]` doesn’t work before.

And it is really good that the key of specified authorization header is case insensitive

---

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [October 30, 2017, 1:29am UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/4 "2017-10-30T01:29:15Z")

</div>

@alexdebrie1

Do you have any ideas that how to let the authorizer to accepts multiple headers?

```
curl --header “X-token: allow” --header “X-department: wireless” https://<api_url> 

```

I need to authorise both headers.

---

<div class="post-metadata">

**Author:** ![alexdebrie1](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/alexdebrie1/32/899_2.png) [@alexdebrie1](https://forum.serverless.com/u/alexdebrie1)\
**Post date:** [October 30, 2017, 1:32am UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/5 "2017-10-30T01:32:32Z")

</div>

@bill I think you’d need to use the [`REQUEST` type](http://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html#api-gateway-custom-authorizer-types) for your custom authorizer. This passes in the entire request rather than just a single header.

---

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [October 30, 2017, 1:33am UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/6 "2017-10-30T01:33:28Z")

</div>

> [@alexdebrie1](#):
>
> REQUEST type

thanks, I am not sure if I fully understand this part, but will take a try.

---

<div class="post-metadata">

**Author:** ![laardee](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/laardee/32/263_2.png) [@laardee](https://forum.serverless.com/u/laardee)\
**Post date:** [November 1, 2017, 6:04am UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/7 "2017-11-01T06:04:00Z")

</div>

Hi, you can either use TOKEN or REQUEST type of custom authorizer with API Gateway. With TOKEN you’ll get only the one header that you have defined as event payload (along with method arn) and with REQUEST you’ll get the whole request event with all headers ([http://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html#api-gateway-custom-authorizer-input](http://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html#api-gateway-custom-authorizer-input)).  
This feature will be supported in the next release of Serverless Framework ([https://github.com/serverless/serverless/pull/4372](https://github.com/serverless/serverless/pull/4372)).

---

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [November 1, 2017, 7:18am UTC](https://forum.serverless.com/t/fixed-authorizer-with-specified-header/2981/8 "2017-11-01T07:18:23Z")

</div>

Thanks, I already built with latest serverless codes and using this feature.