IncompleteSignatureException error response from GraphQL request

Do you want to request a feature or report a bug? Bug

What is the current behavior? In our other app utilizing amazon-cognito-identity-js I could send a request with the header Authorization: Bearer token and authenticate via our APIG’s custom authorizer. Using Amplify I get the error IncompleteSignatureException returned when making my request.

If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem. Your bug will get fixed much faster if we can run your code and it doesn’t have dependencies other than AWS Amplify.

Using withAuthenticator HOC to log in. The API portion of my aws-exports looks like so:

 API: {
    graphql_headers: async () => ({
      Authorization: await Auth.currentAuthenticatedUser().then(user => {
        console.log(user.signInUserSession.idToken.jwtToken);
        return `Bearer ${user.signInUserSession.idToken.jwtToken}`;
      })
    }),
    graphql_endpoint: '/api' // using reverse proxy to reach my API without triggering CORS errors
  }

We have existing infrastructure, so I am deploying via serverless, not aws-mobilehub. This app uses React and we are trying out aws-amplify-react’s Connect component to make the request. I am able to see the POST request in my Network tab, and the request has the Authorization header I am expecting to see, but the response headers contains x-amzn-errortype: IncompleteSignatureException.

With window.LOG_LEVEL = DEBUG enabled I am also seeing this error cropping up in the output:

"[DEBUG] 00:01.968 AWSPinpointProvider - updateEndpoint failed": MissingRequiredParameter
code: "MissingRequiredParameter"
columnNumber: 43
fileName: "http://localhost:3000/static/js/bundle.js"
lineNumber: 49547
message: "Missing required key 'ApplicationId' in params"
name: "MissingRequiredParameter"
stack: ["..."]

We have a identity pool configuration whose id is referenced in the aws-export Auth block. I’m guessing the missing applicationId and signing issue has to do with a mis-configuration of the Amplify tool, but I have been unable to find what that might be from the docs or other reported issues

What is the expected behavior? I should receive my GraphQL response

Which versions of Amplify, and which browser / OS are affected by this issue? Did this work in previous versions? Currently using

"aws-amplify": "0.4.4"
"aws-amplify-react": "0.1.50"

You can turn on the debug mode to provide more info for us by setting window.LOG_LEVEL = 'DEBUG'; in your app.

[dehuszar]

I figured out the issue. APIG just returns misleading error messages.

I have the create-react-app proxy configuration in place. The what the proxy sends out is not console’d anywhere, so I did not see that the proxy configuration was appending a path segment to the target endpoint. This was creating the 403. The fact that AWS doesn’t just say that endpoint doesn’t exist is what threw me off. smh

Is returning a 403 vs a 404 some kind of security through obscurity strategy? It makes things incredibly hard to debug.

I had to use httpbin (httpbin.org) to catch the request contents and see what was happening

[github-actions[bot]]

This issue has been automatically locked since there hasn’t been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.