3rd Authentication & Authorization


Overview

We will turn our WildRydes application into a platform, enabling 3rd party developers to build new applications on top of our APIs

Working with 3rd party developers makes it easier for us to open new markets and geographies as well as new functionality for our riders.

By constrast, we are going to face with several security threats by exposing our APIs to the public Internet.

Architecture

security

  • First we will configure previous Cognito User Pool from module #2 to enable OAuth 2.0 flows.
  • Then, we will create a new method in the application’s API that allows unicorns to list the rides they have given
  • Finally, we will apply several security layers for protecting our APIs.

Steps summary:

  1. Create a new List Rides Lambda function
  2. Create a new custom authorizer Lambda function
  3. Configure the new custom authorizer
  4. Create new API Gateway method
  5. Create S3 bucket for hosting 3rd party site
  6. Config Cognito with for 3rd pary access